Security
فارسی
All products

ci4-cms-erp/ci4ms

Composer · Package
36 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-34989 · GHSA-VR2G-RHM5-Q4JR ci4-cms-erp/ci4ms Composer Critical Fix reported
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation RuleCVE-2026-45270 · GHSA-GQR2-7HCG-RCHF ci4-cms-erp/ci4ms Composer High Fix reported
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operationsCVE-2026-45139 · GHSA-245J-XJVR-XVM5 ci4-cms-erp/ci4ms Composer Medium Fix reported
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation RuleCVE-2026-45138 · GHSA-2M69-JMVH-6CHR ci4-cms-erp/ci4ms Composer Medium Fix reported
CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcessCVE-2026-41890 · GHSA-VGRF-PR28-VF98 ci4-cms-erp/ci4ms Composer Medium Fix reported
CI4MS has a Deactivated User Session Bypass (active=0)CVE-2026-41891 · GHSA-5HFV-C864-QCQ9 ci4-cms-erp/ci4ms Composer Medium Fix reported
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code ExecutionCVE-2026-41587 · GHSA-FW49-9XQ4-GMX6 ci4-cms-erp/ci4ms Composer High Fix reported
CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSSCVE-2026-41201 · GHSA-QXPQ-82F3-XJ47 ci4-cms-erp/ci4ms Composer Medium Fix reported
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCECVE-2026-41202 · GHSA-XP9F-PVVC-57P4 ci4-cms-erp/ci4ms Composer Critical Fix reported
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCECVE-2026-41203 · GHSA-XV3R-VR59-95RG ci4-cms-erp/ci4ms Composer Critical Fix reported
CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-34561 · GHSA-GCFJ-CF7J-VWGJ ci4-cms-erp/ci4ms Composer Critical Fix reported
CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)CVE-2026-34572 · GHSA-8FQ3-C5W3-PJ3Q ci4-cms-erp/ci4ms Composer High Fix reported
CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSSCVE-2026-34563 · GHSA-85M8-G393-JCXF ci4-cms-erp/ci4ms Composer Critical Fix reported
CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSSCVE-2026-35035 · GHSA-5GHQ-42RG-769X ci4-cms-erp/ci4ms Composer Critical Fix reported
ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-27599 · GHSA-66M2-V9V9-95C3 ci4-cms-erp/ci4ms Composer Critical Fix reported
CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install ControllerCVE-2026-39394 · GHSA-VFHX-5459-QHQH ci4-cms-erp/ci4ms Composer High Fix reported
CI4MS has stored XSS via Unescaped Blacklist Note in Admin User ListCVE-2026-39391 · GHSA-7CM9-V848-CFH2 ci4-cms-erp/ci4ms Composer Medium Fix reported
CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe settingCVE-2026-39390 · GHSA-X3HR-CP7X-44R2 ci4-cms-erp/ci4ms Composer Medium Fix reported
CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard BypassCVE-2026-39393 · GHSA-8RH5-4MVX-XJ7J ci4-cms-erp/ci4ms Composer High Fix reported
CI4MS has stored XSS in Pages Content Due to Missing html_purify SanitizationCVE-2026-39392 · GHSA-FJPJ-6QCQ-6PW2 ci4-cms-erp/ci4ms Composer Medium Fix reported