CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application renders user-controlled input unsafely within the logs interface. If any stored XSS payload exists within logged data, it is rendered without proper output encoding. This issue becomes a Blind XSS scenario because the attacker does not see immediate execution. Instead, the payload is stored within application logs and only executes later when an administrator views the logs page. This issue has been patched in version 0.31.0.0.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-r4v5-rwr2-q7r4 Exploit, Vendor Advisory
- https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-r4v5-rwr2-q7r4 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.0 · ci4-cms-erpNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:ci4-cms-erp:ci4ms:*:*:*:*:*:*:*:*
References 3
- https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 Release Notes
- https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-r4v5-rwr2-q7r4 Exploit, Vendor Advisory
- https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-r4v5-rwr2-q7r4 Exploit, Vendor Advisory