A critical stored DOM-based blind cross-site scripting (XSS) vulnerability exists in the public-facing landing pages of the ci4-cms-erp/ci4ms platform. This flaw is located in the System Settings Company Information section and allows attackers to inject malicious scripts. Successful exploitation can lead to full account takeover and privilege escalation across all user roles, resulting in complete platform compromise. The vulnerability affects versions prior to 0.31.2.0 and has been assigned CVE-2026-35035 with a CVSS score of 9.1. A patch is available in version 0.31.2.0 to remediate this issue.