CVE-2026-34564Disclosure(ci4-cms-erp / ci4ms)

LOWCVSS 9.0 · CRITICAL

Signal is active with 4 mentions in latest observed window

Immediate actions

Patch ci4-cms-erp ci4ms systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when adding Pages to navigation menus through the Menu Management functionality. Page-related data selected via the Pages section is stored server-side and rendered without proper output encoding. This stored payload is later rendered unsafely within administrative interfaces and public-facing navigation menus, leading to stored DOM-based cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.

ci4-cms-erp CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

Other references

https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ci4ms

Threat summary

Patch or workaround signal is available
4 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
General: 1 classified signal
4 total mentions across 1 day

Affected systems

Vendors

ci4-cms-erp

Products

ci4ms

Deep dive

Activity timeline4 mentions / 1d

Signal classification3 categories

Disclosure

250.0%

General

125.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Full discourse4 posts

PulsePatch.io@pulsepatchio189d
Disclosure
A stored DOM XSS vulnerability (CVE-2026-34564) affects the `CI4MS Menu Management (Pages)` component in an `Unknown` product, enabling full account takeover and privilege escalation. #XSS #Security #InfoSec https://www.pulsepatch.io/posts/cve-2026-34564-unknown-ci4ms-xss-account-takeover
Post summary
The post announces a new stored DOM XSS vulnerability (CVE-2026-34564) in an unknown product’s CI4MS Menu Management component, highlighting its potential to enable account takeover and privilege escalation.
0000044
6 followersView on X
CVEFind.com@CveFindCom189d
Patch
[CVE-2026-34564: CRITICAL] CI4MS, a CodeIgniter 4-based CMS, had a vulnerability allowing stored DOM-based XSS. Update to version 0.31.0.0 or later to patch this security issue. #cybersecurity#cve,CVE-2026-34564,#cybersecurity https://cvefind.com/CVE-2026-34564
Post summary
CI4MS has a stored DOM‑based XSS vulnerability (CVE‑2026‑34564) and recommends updating to version 0.31.0.0 or newer; no exploit details or active attacks are mentioned.
0000036
617 followersView on X
CVE@CVEnew189d
General
CVE-2026-34564 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.… https://www.cve.org/CVERecord?id=CVE-2026-34564
Post summary
The excerpt merely references the existence of CVE-2026-34564 for a CodeIgniter 4 CMS skeleton and links to the CVE record, without providing additional technical or operational details.
00000136
56.9K followersView on X
The Hacker Wire@TheHackerWire189d
Disclosure
🔴 CVE-2026-34564 - Critical CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fa... https://www.thehackerwire.com/vulnerability/CVE-2026-34564/ https://t.co/oNQNz3VpvA
Post summary
A critical CVE-2026-34564 has been disclosed affecting CI4MS before v0.31.0.0, but no exploitation details, PoC, or patch information are provided.
0000052
163 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	ci4-cms-erp	ci4ms	-	-	-

Explore more

Back to dashboard ci4-cms-erp CVEs ci4ms vulnerabilities

What researchers are saying

CVE-2026-34564

PulsePatch.io@pulsepatchioDisclosure

The post announces a new stored DOM XSS vulnerability (CVE-2026-34564) in an unknown product’s CI4MS Menu Management component, highlighting its potential to enable account takeover and privilege escalation.

CVEFind.com@CveFindComPatch

CI4MS has a stored DOM‑based XSS vulnerability (CVE‑2026‑34564) and recommends updating to version 0.31.0.0 or newer; no exploit details or active attacks are mentioned.

CVE@CVEnewGeneral

The excerpt merely references the existence of CVE-2026-34564 for a CodeIgniter 4 CMS skeleton and links to the CVE record, without providing additional technical or operational details.

The Hacker Wire@TheHackerWireDisclosure

A critical CVE-2026-34564 has been disclosed affecting CI4MS before v0.31.0.0, but no exploitation details, PoC, or patch information are provided.