CVE-2026-34569 is a critical stored cross-site scripting (XSS) vulnerability in ci4ms, a CodeIgniter 4-based CMS skeleton. Versions prior to 0.31.0.0 do not properly sanitize user input in the blog category title field, allowing attackers to inject malicious JavaScript payloads. These payloads are stored server-side and rendered unsafely on public blog category pages, admin interfaces, and blog post views without proper output encoding. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has been patched in version 0.31.0.
CVE-2026-34568 is a critical stored cross-site scripting (XSS) vulnerability in the ci4ms CMS based on CodeIgniter 4. Versions prior to 0.31.0.0 do not properly sanitize user input when creating or editing blog posts, allowing attackers to inject malicious JavaScript payloads. These payloads are stored server-side and rendered unsafely in multiple views without proper output encoding. This vulnerability has been patched in version 0.31.0.0.
CVE-2026-34567 is a critical stored cross-site scripting (XSS) vulnerability in the ci4ms application, a CodeIgniter 4-based CMS skeleton. Versions prior to 0.31.0.0 do not properly sanitize user input when creating or editing blog post categories, allowing attackers to inject malicious JavaScript payloads. These payloads are stored server-side and rendered unsafely when categories are viewed, leading to potential compromise of confidentiality, integrity, and availability. The issue has been patched in version 0.31.0.0.
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Page Management functionality when creating or editing pages. Multiple input fields accept attacker-controlled JavaScript payloads that are stored server-side. These stored values are later rendered without proper output encoding across administrative page lists and public-facing page views, leading to stored DOM-based cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.
CI4MS versions prior to 0.31.0.0 contain a stored DOM-based cross-site scripting (XSS) vulnerability in the Menu Management functionality. This occurs because user-controlled input related to Posts added to navigation menus is stored and later rendered without proper output encoding. The vulnerability affects both administrative dashboards and public-facing navigation menus. It has been patched in version 0.31.0.0.
CVE-2026-34564 is a critical stored DOM-based cross-site scripting (XSS) vulnerability in ci4ms, a CodeIgniter 4-based CMS. Versions prior to 0.31.0.0 improperly sanitize user input when adding Pages to navigation menus, causing unsafe rendering of stored payloads in both administrative and public interfaces. This can lead to high-impact consequences including partial confidentiality loss, limited integrity compromise, and availability degradation. The issue has been fixed in version 0.31.0.0.
CI4MS versions prior to 0.31.0.0 contain a stored blind cross-site scripting (XSS) vulnerability due to improper sanitization of user input in backup uploads and metadata processing. An attacker can inject malicious JavaScript into backup filenames, which is then rendered unsafely in backup management views. This vulnerability has been patched in version 0.31.0.0.
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative configuration fields accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. This issue has been patched in version 0.31.0.0.
CVE-2026-34561 is a medium severity cross-site scripting (XSS) vulnerability in ci4ms, a CodeIgniter 4-based CMS skeleton. Versions prior to 0.31.0.0 do not properly sanitize user input in the System Settings – Social Media Management section, allowing attacker-controlled data to be stored and rendered without proper encoding. This can lead to limited confidentiality, integrity, and availability impacts. The issue has been patched in version 0.31.0.0.
CVE-2026-34560 is a critical stored Cross-site Scripting (XSS) vulnerability in ci4ms, a CodeIgniter 4-based CMS. Versions prior to 0.31.0.0 render user-controlled input unsafely within the logs interface, allowing stored XSS payloads to execute when an administrator views the logs. This is a Blind XSS scenario because the attacker does not see immediate execution. The vulnerability has been patched in version 0.31.0.0.
CI4MS, a CodeIgniter 4-based CMS, contained a stored cross-site scripting (XSS) vulnerability in versions prior to 0.31.0.0. The vulnerability arises from improper sanitization of user input in the blog tag name field, allowing attackers to inject malicious JavaScript payloads. These payloads are stored server-side and rendered unsafely on public and administrative tag pages without proper output encoding. This issue has been addressed and patched in version 0.31.0.0.
CI4MS versions prior to 0.31.0.0 contain a stored DOM-based Cross-Site Scripting (XSS) vulnerability in the Methods Management functionality. The application fails to properly sanitize or encode user-controlled input, allowing attacker-supplied JavaScript payloads to be stored and later rendered in administrative interfaces and navigation components. This vulnerability has been patched in version 0.31.0.0. The CVSS score is 9.
CI4MS versions prior to 0.31.0.0 contain a stored cross-site scripting (XSS) vulnerability in the group and role management functionality. The application fails to properly sanitize user input in multiple group-related fields, allowing malicious JavaScript payloads to be stored server-side. These payloads are then rendered unsafely in privileged administrative views without proper output encoding, leading to stored XSS within the role and permission management context. This vulnerability has been patched in version 0.31.0.0.
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within System Settings – Mail Settings. Several configuration fields, including Mail Server, Mail Port, Email Address, Email Password, Mail Protocol, and TLS settings, accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. This issue has been patched in version 0.31.0.0.
CVE-2026-25510 is a critical vulnerability in ci4ms, a CodeIgniter 4-based CMS, allowing authenticated users with file editor permissions to upload and execute arbitrary PHP code via unrestricted file uploads. This leads to Remote Code Execution (RCE) without user interaction. The flaw affects versions prior to 0.28.5.0 and has been patched in that release. Exploitation requires authentication but no additional user interaction. The vulnerability impacts confidentiality, integrity, and availability severely, with a CVSS score of 10. European organizations using ci4ms in their web infrastructure are at risk, especially those with exposed or poorly segmented administrative interfaces. Mitigation involves upgrading to version 0.
CVE-2026-25509 is a medium severity vulnerability in the ci4ms CMS based on CodeIgniter 4, allowing unauthenticated attackers to enumerate registered email addresses via observable response discrepancies during the password reset process. This email enumeration flaw can aid attackers in identifying valid user accounts, facilitating targeted phishing or brute-force attacks. The vulnerability affects ci4ms versions prior to 0.28.5.0 and has been patched in that release. Exploitation requires no authentication or user interaction and can be performed remotely over the network. While it does not directly impact system integrity or availability, the confidentiality of user registration data is compromised. European organizations using ci4ms should upgrade promptly to mitigate this risk. Countries with higher adoption of CodeIgniter-based CMS solutions and significant enterprise or government use of ci4ms are more likely to be affected.