CVE-2026-34989 is a stored cross-site scripting vulnerability in the ci4ms product of the ci4-cms-erp project. Before version 31.0.0.0, the application fails to properly sanitize user-controlled input when users update their profile name, allowing malicious JavaScript code to be stored server-side and later rendered unsafely in multiple views without proper output encoding. This leads to stored XSS, enabling attackers to execute arbitrary scripts in the context of other users' browsers. The vulnerability is classified under CWE-79 and has a CVSS 4.0 score of 9.4, indicating critical impact with network attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, availability, and security requirements. The issue is resolved in version 31.0.0.0.

An attacker can inject malicious JavaScript into profile name fields, which is stored and later rendered unsafely in the application, leading to stored cross-site scripting. This can result in unauthorized script execution in users' browsers, potentially compromising user sessions, stealing sensitive information, or performing actions on behalf of users. The vulnerability has a critical severity rating (CVSS 9.4) with high impacts on confidentiality, integrity, availability, and security controls. There are no known exploits in the wild as of the published date.

Upgrade to ci4ms version 31.0.0.0 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, confirm the upgrade from the vendor's official release notes or repository. Avoid using affected versions prior to 31.0.0.0. No additional mitigation guidance is provided in the input data.