Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when handling backup uploads and processing backup metadata. An attacker can inject a malicious JavaScript payload into the backup filename via the uploaded xss.sql, which uses SQL functionality to insert the XSS payload server-side. This stored payload is later rendered unsafely in multiple backup management views without proper output encoding, leading to stored blind cross-site scripting (Blind XSS). This issue has been patched in version 0.31.0.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-02 | 3 | Disclosure1General1Patch1 |
| 2026-04-03 | 1 | Disclosure1 |
CVE-2026-34563 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.… https://www.cve.org/CVERecord?id=CVE-2026-34563
Post summary
The post merely references the CVE record for CI4MS without providing technical, exploit, or mitigation details.
A critical stored DOM Blind XSS (CVE-2026-34563) in `CI4MS` Backup Management enables full account takeover & privilege escalation. #XSS #InfoSec #CyberSecurity https://www.pulsepatch.io/posts/cve-2026-34563-ci4ms-backup-management-blind-xss
Post summary
The post announces CVE‑2026‑34563, a critical stored DOM Blind XSS in CI4MS Backup Management that enables full account takeover and privilege escalation, providing technical details but no patches or exploitation evidence.
[CVE-2026-34563: CRITICAL] CodeIgniter 4-based CMS CI4MS patched a blind cross-site scripting vulnerability in backup processing. Ensure to update to version 0.31.0.0 for secure usage. CyberSecurity.#cve,CVE-2026-34563,#cybersecurity https://cvefind.com/CVE-2026-34563
Post summary
The post announces a critical blind XSS vulnerability in CodeIgniter CMS CI4MS and directs users to update to version 0.31.0.0 for remediation.
🔴 CVE-2026-34563 - Critical CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fa... https://www.thehackerwire.com/vulnerability/CVE-2026-34563/ https://t.co/nC8D7BqpeB
Post summary
The message announces CVE-2026-34563 as a critical vulnerability in the CI4MS CodeIgniter 4 CMS skeleton and provides a link for additional information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ci4-cms-erp | ci4ms | - | - | - |