ci4-cms-erp ci4ms

• CVE-2026-45270 High 8.7 CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule 0.3%
• CVE-2026-45139 Medium 6.5 CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations 0.3%
• CVE-2026-45138 Medium 5.4 CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule 0.2%
• CVE-2026-41891 Medium 5.3 CI4MS: Deactivated User Session Bypass (active=0) 0.3%
• CVE-2026-41890 Medium 6.9 CI4MS: Arbitrary Database Table Drop via Theme deleteProcess 0.4%
• CVE-2026-41203 Critical 9.4 ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE 0.6%
• CVE-2026-41202 Critical 9.4 ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE 0.7%
• CVE-2026-41201 Critical 9.1 CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2 0.3%
• CVE-2026-41587 High 8.6 CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution 0.6%
• CVE-2026-39394 High 8.1 CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller 0.5%
• CVE-2026-39393 High 8.1 Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms 0.4%
• CVE-2026-39392 Medium 5.5 CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization 0.3%
• CVE-2026-39391 Medium 4.8 CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List 0.2%
• CVE-2026-39390 Medium 5.5 CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting 0.2%
• CVE-2026-39389 Medium 6.7 CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files 0.5%
• CVE-2026-35035 High 7.2 CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS 0.5%
• CVE-2026-34989 Critical 9.4 CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.3%
• CVE-2026-34572 High 8.8 CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) 0.5%
• CVE-2026-34571 Critical 10.0 CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise 0.4%
• CVE-2026-34570 High 8.8 CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) 0.5%
• CVE-2026-34569 Critical 10.0 CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.3%
• CVE-2026-34568 Critical 9.1 CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.3%
• CVE-2026-34567 Critical 9.1 CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.3%
• CVE-2026-34566 Critical 9.1 CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.3%
• CVE-2026-34565 Critical 9.1 CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.3%
• CVE-2026-34564 Critical 9.1 CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.3%
• CVE-2026-34563 Critical 9.1 CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS 0.3%
• CVE-2026-34562 Medium 4.7 CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.3%
• CVE-2026-34561 Medium 4.7 CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.2%
• CVE-2026-34560 Critical 9.1 CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.4%
• CVE-2026-34559 Critical 9.1 CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.3%
• CVE-2026-34558 Critical 9.1 CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.3%
• CVE-2026-34557 Critical 9.1 CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.3%
• CVE-2026-27599 Medium 4.7 CI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 0.4%
• CVE-2026-25510 Critical 10.0 CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor 0.9%
• CVE-2026-25509 Medium 5.3 CI4MS Vulnerable to User Email Enumeration via Password Reset Flow 0.4%