MEDIUM6.5Packagist
GHSA-245j-xjvr-xvm5· CVE-2026-45139CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
Modified: 5/18/2026
package
Packagist/ci4-cms-erp/ci4ms
pkg:packagist/ci4-cms-erp/ci4ms
MEDIUM5.4Packagist
GHSA-2m69-jmvh-6chr· CVE-2026-45138CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
Modified: 5/18/2026
CRITICAL9.1Packagist
GHSA-4333-387x-w245· CVE-2026-34559CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 4/6/2026
CRITICAL9.1Packagist
GHSA-458r-h248-29c5· CVE-2026-34566CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 4/6/2026
HIGH8.8Packagist
GHSA-4vxv-4xq4-p84h· CVE-2026-34570CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
Modified: 4/6/2026
CRITICAL9.1Packagist
GHSA-5ghq-42rg-769x· CVE-2026-35035CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS
Modified: 5/5/2026
MEDIUMPackagist
GHSA-5hfv-c864-qcq9· CVE-2026-41891CI4MS has a Deactivated User Session Bypass (active=0)
Modified: 5/8/2026
MEDIUM5.3Packagist
GHSA-654x-9q7r-g966· CVE-2026-25509CI4MS Vulnerable to User Email Enumeration via Password Reset Flow
Modified: 2/11/2026
CRITICAL9.1Packagist
GHSA-66m2-v9v9-95c3· CVE-2026-27599ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 5/5/2026
MEDIUM4.8Packagist
GHSA-7cm9-v848-cfh2· CVE-2026-39391CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List
Modified: 4/8/2026
CRITICAL9.9Packagist
GHSA-85m8-g393-jcxf· CVE-2026-34563CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS
Modified: 5/5/2026
HIGH8.8Packagist
GHSA-8fq3-c5w3-pj3q· CVE-2026-34572CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
Modified: 5/5/2026
HIGH8.1Packagist
GHSA-8rh5-4mvx-xj7j· CVE-2026-39393CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass
Modified: 4/8/2026
MEDIUM6.7Packagist
GHSA-9rxp-f27p-wv3h· CVE-2026-39389CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files
Modified: 4/8/2026
CRITICAL9.9Packagist
GHSA-fc4p-p49v-r948· CVE-2026-34571CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise
Modified: 4/6/2026
CRITICAL9.9Packagist
GHSA-fhrf-q333-82fm· CVE-2026-34569CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 4/6/2026
MEDIUM5.5Packagist
GHSA-fjpj-6qcq-6pw2· CVE-2026-39392CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization
Modified: 4/8/2026
HIGHPackagist
GHSA-fw49-9xq4-gmx6· CVE-2026-41587CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
Modified: 5/8/2026
CRITICAL9.1Packagist
GHSA-g4pp-fhgf-8653· CVE-2026-34564CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 4/6/2026
CRITICAL9.1Packagist
GHSA-gcfj-cf7j-vwgj· CVE-2026-34561CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 5/5/2026
CRITICAL9.9Packagist
GHSA-gp56-f67f-m4px· CVE-2026-25510CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
Modified: 2/4/2026
HIGH8.7Packagist
GHSA-gqr2-7hcg-rchf· CVE-2026-45270CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Modified: 5/18/2026
MEDIUM6.8Packagist
GHSA-qxpq-82f3-xj47· CVE-2026-41201CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS
Modified: 5/8/2026
CRITICAL9.1Packagist
GHSA-r33w-c82v-x5v7· CVE-2026-34567CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 4/6/2026
CRITICAL9.1Packagist
GHSA-r4v5-rwr2-q7r4· CVE-2026-34560CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 4/6/2026
CRITICAL9.1Packagist
GHSA-rpjr-985c-qhvm· CVE-2026-34557CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 4/1/2026
CRITICAL9.1Packagist
GHSA-v77r-xg3p-75g7· CVE-2026-34558CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 4/1/2026
MEDIUM4.7Packagist
GHSA-v897-c6vq-6cr3· CVE-2026-34562CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 4/6/2026
HIGH8.1Packagist
GHSA-vfhx-5459-qhqh· CVE-2026-39394CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
Modified: 4/8/2026
MEDIUMPackagist
GHSA-vgrf-pr28-vf98· CVE-2026-41890CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess
Modified: 5/8/2026
CRITICAL9.0Packagist
GHSA-vr2g-rhm5-q4jr· CVE-2026-34989CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 9/10/2026
MEDIUM5.5Packagist
GHSA-x3hr-cp7x-44r2· CVE-2026-39390CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting
Modified: 4/8/2026
CRITICAL9.1Packagist
GHSA-x7wh-g25g-53vg· CVE-2026-34568CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 4/6/2026
CRITICAL9.1Packagist
GHSA-xgh5-w62m-8mpr· CVE-2026-34565CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Modified: 4/6/2026
CRITICALPackagist
GHSA-xp9f-pvvc-57p4· CVE-2026-41202CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Modified: 5/8/2026
CRITICALPackagist
GHSA-xv3r-vr59-95rg· CVE-2026-41203CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Modified: 5/8/2026