Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog tags. An attacker can inject a malicious JavaScript payload into the tag name field, which is then stored server-side. This stored payload is later rendered unsafely across public tag pages and administrative interfaces without proper output encoding, leading to stored cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-02 | 3 | Disclosure1General1Patch1 |
| 2026-04-03 | 1 | Disclosure1 |
CVE-2026-34559 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.… https://www.cve.org/CVERecord?id=CVE-2026-34559
Post summary
The post announces CVE-2026-34559 for CI4MS, noting affected versions before 0.31.0, but offers no further technical details or exploitation information.
An unspecified product, `CI4MS: Blogs Tags`, is vulnerable to Stored DOM #XSS (CVE-2026-34559) leading to account takeover & privilege escalation. Review your `CI4MS` installations for this critical #infosec issue. https://www.pulsepatch.io/posts/cve-2026-34559-ci4ms-dom-xss-account-takeover
Post summary
The statement announces CVE-2026-34559, a stored DOM XSS flaw in CI4MS: Blogs Tags that can cause account takeover and privilege escalation, urging users to verify their installations.
[CVE-2026-34559: CRITICAL] Beware: CI4MS CMS prior to v0.31.0.0 has a stored XSS vulnerability! Update to the latest version to stay secure against malicious JavaScript injections in tag names. #cybersecurity#cve,CVE-2026-34559,#cybersecurity https://cvefind.com/CVE-2026-34559
Post summary
The tweet alerts users to CVE-2026-34559, a critical stored XSS in CI4MS CMS, and urges them to update to the latest version to mitigate the vulnerability.
🔴 CVE-2026-34559 - Critical CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fa... https://www.thehackerwire.com/vulnerability/CVE-2026-34559/ https://t.co/xbbQADMUU9
Post summary
The post announces CVE‑2026‑34559 and labels it critical, but it lacks technical details, proof‑of‑concept, exploit code, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ci4-cms-erp | ci4ms | - | - | - |