Ci4-cms-erp vulnerabilities
36 CVEs and advisories name Ci4-cms-erp as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-45270CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
- CVE-2026-45139CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
- CVE-2026-45138CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
- CVE-2026-41891CI4MS: Deactivated User Session Bypass (active=0)
- CVE-2026-41890CI4MS: Arbitrary Database Table Drop via Theme deleteProcess
- CVE-2026-41203ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE
- CVE-2026-41202ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE
- CVE-2026-41201CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2
- CVE-2026-41587CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution
- CVE-2026-39394CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
- CVE-2026-39393Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms
- CVE-2026-39392CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization
- CVE-2026-39391CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List
- CVE-2026-39390CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting
- CVE-2026-39389CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files
- CVE-2026-35035CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS
- CVE-2026-34989CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
- CVE-2026-34572CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
- CVE-2026-34571CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise
- CVE-2026-34570CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
- CVE-2026-34569CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
- CVE-2026-34568CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
- CVE-2026-34567CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
- CVE-2026-34566CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
- CVE-2026-34565CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
- CVE-2026-34564CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
- CVE-2026-34563CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS
- CVE-2026-34562CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
- CVE-2026-34561CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
- CVE-2026-34560CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS