The ci4ms CMS prior to version 0.31.2.0 contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of user-controlled input in administrative configuration fields under System Settings – Company Information. These fields accept attacker-controlled input that is persisted in the database and later rendered unsafely on public-facing pages without proper output encoding. This allows an attacker with administrative privileges to inject malicious scripts that execute in the context of users visiting the public frontend. The vulnerability is fixed in version 0.31.2.0.

Successful exploitation allows an attacker with administrative access to inject malicious scripts into public-facing pages, potentially leading to full compromise of confidentiality, integrity, and availability of the affected web application as indicated by the CVSS vector (C:H/I:H/A:H). The vulnerability does not impact the administrative dashboard directly but affects all users who visit the public frontend where the injected content is rendered.

Upgrade ci4ms to version 0.31.2.0 or later, where this vulnerability has been fixed. There is no indication of alternative mitigations or temporary fixes. Patch status is not explicitly stated but the vendor has released a fixed version, so applying this update is the recommended remediation.