GitHub Advisoryadvisory · Packagist

GHSA-5ghq-42rg-769x CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

CRITICAL Published 2026-04-06 Modified 2026-04-30 Official page ↗
Aliases
CVE-2026-35035
Ecosystem
Packagist
Packages
ci4-cms-erp/ci4ms
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2026-04-06

Affected packages

• Packagist ci4-cms-erp/ci4ms: < 0.31.2.0 → fixed in 0.31.2.0

Description

An attacker can acheive Full Account Takeover & Privilege Escalation via Stored DOM Blind XSS on public-facing landing pages through the System Settings Company Information section which allows the injection of XSS payloads

Related

Alias · CVE (1)

  • CVE-2026-35035 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References