CVE-2026-34566Disclosure(ci4-cms-erp / ci4ms)

LOWCVSS 9.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch ci4-cms-erp ci4ms systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Page Management functionality when creating or editing pages. Multiple input fields accept attacker-controlled JavaScript payloads that are stored server-side. These stored values are later rendered without proper output encoding across administrative page lists and public-facing page views, leading to stored DOM-based cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.

ci4-cms-erp CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-458r-h248-29c5

Other references

https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ci4ms

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 2d ago at 3 mentions (2026-04-02); latest day: 1
5 total mentions across 3 days

Affected systems

Vendors

ci4-cms-erp

Products

ci4ms

Deep dive

Activity timeline5 mentions / 3d

Signal classification3 categories

Disclosure

360.0%

General

120.0%

Patch

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-02	3	Disclosure1General1Patch1
2026-04-03	1	Disclosure1
2026-04-04	1	Disclosure1

Full discourse5 posts

0day Signal@0dayPublishing188d
Disclosure
🚨 CVE-2026-34566: CI4MS: Pages Management Full Acc... Stored XSS in CI4MS page management bypasses all auth layers - low-priv users can steal admin sessions and pivot to ful... https://zerodaysignal.com/vulnerability/CVE-2026-34566 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces a stored XSS vulnerability in CI4MS page management that lets low‑privilege users steal admin sessions, but it lacks details on exploits, active use, or patches.
0000067
204 followersView on X
PulsePatch.io@pulsepatchio189d
Disclosure
A critical Stored DOM XSS (CVE-2026-34566) affects `CI4MS` Pages Management. This vulnerability enables full account takeover and privilege escalation. Monitor vendor advisories for updates. #XSS #AppSec #CVE https://www.pulsepatch.io/posts/cve-2026-34566-ci4ms-dom-xss-account-takeover
Post summary
The tweet announces CVE‑2026‑34566 as a critical Stored DOM XSS in CI4MS Pages Management that can lead to account takeover, with no exploit code or patch details provided; readers are urged to watch vendor advisories for updates.
0000035
10 followersView on X
CVEFind.com@CveFindCom190d
Patch
[CVE-2026-34566: CRITICAL] CI4MS, a CodeIgniter 4-based CMS, fixed a crucial security flaw in version 0.31.0.0 that could lead to stored DOM-based XSS attacks due to improper user input sanitization in Page ...#cve,CVE-2026-34566,#cybersecurity https://cvefind.com/CVE-2026-34566
Post summary
CI4MS remedied CVE‑2026‑34566, a stored DOM‑based XSS vulnerability, by releasing an update (v0.31.0.0).
0000032
617 followersView on X
CVE@CVEnew190d
General
CVE-2026-34566 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.… https://www.cve.org/CVERecord?id=CVE-2026-34566
Post summary
The text merely notes the existence of CVE‑2026‑34566 with a brief description of the affected software; it provides no actionable details or evidence of exploitation.
00000129
56.9K followersView on X
The Hacker Wire@TheHackerWire190d
Disclosure
🔴 CVE-2026-34566 - Critical CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fa... https://www.thehackerwire.com/vulnerability/CVE-2026-34566/ https://t.co/oLQk3DLVuL
Post summary
The text announces a new critical vulnerability (CVE‑2026‑34566) affecting CI4MS but provides no evidence of exploitation, PoC, or mitigation details.
0000054
163 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	ci4-cms-erp	ci4ms	-	-	-

Explore more

Back to dashboard ci4-cms-erp CVEs ci4ms vulnerabilities

What researchers are saying

CVE-2026-34566

0day Signal@0dayPublishingDisclosure

The post announces a stored XSS vulnerability in CI4MS page management that lets low‑privilege users steal admin sessions, but it lacks details on exploits, active use, or patches.

PulsePatch.io@pulsepatchioDisclosure

The tweet announces CVE‑2026‑34566 as a critical Stored DOM XSS in CI4MS Pages Management that can lead to account takeover, with no exploit code or patch details provided; readers are urged to watch vendor advisories for updates.

CVEFind.com@CveFindComPatch

CI4MS remedied CVE‑2026‑34566, a stored DOM‑based XSS vulnerability, by releasing an update (v0.31.0.0).

CVE@CVEnewGeneral

The text merely notes the existence of CVE‑2026‑34566 with a brief description of the affected software; it provides no actionable details or evidence of exploitation.

The Hacker Wire@TheHackerWireDisclosure

The text announces a new critical vulnerability (CVE‑2026‑34566) affecting CI4MS but provides no evidence of exploitation, PoC, or mitigation details.