ci4-cms-erp vulnerabilities

Newest CVEs

• CVE-2026-45270

  CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

  ci4-cms-erp · ci4ms

  High8.7
• CVE-2026-45139

  CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations

  ci4-cms-erp · ci4ms

  Medium6.5
• CVE-2026-45138

  CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule

  ci4-cms-erp · ci4ms

  Medium5.4
• CVE-2026-41891

  CI4MS: Deactivated User Session Bypass (active=0)

  ci4-cms-erp · ci4ms

  Medium5.3
• CVE-2026-41890

  CI4MS: Arbitrary Database Table Drop via Theme deleteProcess

  ci4-cms-erp · ci4ms

  Medium6.9
• CVE-2026-41203

  ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE

  ci4-cms-erp · ci4ms

  Critical9.4
• CVE-2026-41202

  ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE

  ci4-cms-erp · ci4ms

  Critical9.4
• CVE-2026-41201

  CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2

  ci4-cms-erp · ci4ms

  Critical9.1
• CVE-2026-41587

  CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution

  ci4-cms-erp · ci4ms

  High8.6
• CVE-2026-39394

  CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller

  ci4-cms-erp · ci4ms

  High8.1