Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within group and role management functionality. Multiple input fields (three distinct group-related fields) can be injected with malicious JavaScript payloads, which are then stored server-side. These stored payloads are later rendered unsafely within privileged administrative views without proper output encoding, leading to stored cross-site scripting (XSS) within the role and permission management context. This issue has been patched in version 0.31.0.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-30 | 2 | General1Patch1 |
| 2026-03-31 | 2 | Disclosure1General1 |
| 2026-04-01 | 1 | Disclosure1 |
CVE-2026-34557 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.… https://www.cve.org/CVERecord?id=CVE-2026-34557
Post summary
The message merely references the CVE record for CI4MS with no additional technical details, PoC, or exploitation information.
🔴 CVE-2026-34557 - Critical CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fa... https://www.thehackerwire.com/vulnerability/CVE-2026-34557/ https://t.co/ayTWOGTpDu
Post summary
The tweet references a critical CVE for CI4MS with minimal detail, lacking explicit include of PoC, exploit, patch, or technical specifics.
[CVE-2026-34557: CRITICAL] CI4MS CMS skeleton, based on CodeIgniter 4, fixed a vulnerability in versions prior to 0.31.0.0 allowing stored cross-site scripting attacks via unsanitized user input in group and...#cve,CVE-2026-34557,#cybersecurity https://cvefind.com/CVE-2026-34557
Post summary
The post announces CVE‑2026‑34557, a critical stored XSS flaw in CI4MS CMS, and indicates that versions prior to 0.31.0.0 are affected while newer releases contain a fix.
A critical Stored DOM XSS (CVE-2026-34557) in `CI4MS` Permissions Management enables full account takeover and privilege escalation. #CI4MS #XSS #infosec https://www.pulsepatch.io/posts/cve-2026-34557-ci4ms-stored-dom-xss-account-takeover
Post summary
The message announces a new critical stored DOM XSS vulnerability (CVE-2026-34557) in CI4MS Permissions Management, stating it allows complete account takeover and privilege escalation.
🚨 CVE-2026-34557: CI4MS: Permissions Management Fu... Stored XSS in RBAC admin panels = instant privilege escalation to god mode - attackers can inject JS into role manageme... https://zerodaysignal.com/vulnerability/CVE-2026-34557 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
CVE‑2026‑34557 is a stored XSS in CI4MS RBAC admin panels that can cause privilege escalation, with details on the vulnerability type but no PoC, exploit, or patch information provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ci4-cms-erp | ci4ms | - | - | - |