What’s Vulnerable › Products
ci4-cms-erp ci4ms vulnerabilities
36 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 36 published in the last 12 months.
Check whether your ci4-cms-erp ci4ms version is affected
Latest ci4-cms-erp ci4ms vulnerabilities
- CVE-2026-45270 — CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule (CVSS 8.7)
- CVE-2026-45139 — CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations (CVSS 6.5)
- CVE-2026-45138 — CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule (CVSS 5.4)
- CVE-2026-41891 — CI4MS: Deactivated User Session Bypass (active=0) (CVSS 5.3)
- CVE-2026-41890 — CI4MS: Arbitrary Database Table Drop via Theme deleteProcess (CVSS 6.9)
- CVE-2026-41587 — CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution (CVSS 8.6)
- CVE-2026-41203 — ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE (CVSS 9.4)
- CVE-2026-41202 — ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE (CVSS 9.4)
- CVE-2026-41201 — CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2 (CVSS 9.1)
- CVE-2026-39394 — CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller (CVSS 9.8)
- CVE-2026-39393 — Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms (CVSS 8.1)
- CVE-2026-39392 — CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization (CVSS 4.8)
- CVE-2026-39391 — CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List (CVSS 4.8)
- CVE-2026-39390 — CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting (CVSS 4.8)
- CVE-2026-39389 — CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files (CVSS 7.2)
- CVE-2026-35035 — CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS (CVSS 9.0)
- CVE-2026-34989 — CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (CVSS 9.0)
- CVE-2026-34572 — CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) (CVSS 8.8)
- CVE-2026-34571 — CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise (CVSS 9.0)
- CVE-2026-34570 — CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) (CVSS 8.8)
- CVE-2026-34569 — CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (CVSS 9.0)
- CVE-2026-34568 — CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (CVSS 9.0)
- CVE-2026-34567 — CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (CVSS 9.0)
- CVE-2026-34566 — CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (CVSS 9.0)
- CVE-2026-34565 — CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (CVSS 9.0)