VulnSocial

CVE-2026-34567Disclosure(ci4-cms-erp / ci4ms)

LOWCVSS 9.0 · CRITICAL

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Patch ci4-cms-erp ci4ms systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog posts within the Categories section. An attacker can inject a malicious JavaScript payload into the Categories content, which is then stored server-side. This stored payload is later rendered unsafely when the Categories are viewed via blog posts, without proper output encoding, leading to stored cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.

ci4-cms-erp CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • ci4ms

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked at 4 mentions on most recent observed day (2026-04-02)
  • 5 total mentions across 2 days

Affected systems

Vendors
ci4-cms-erp
Products
ci4ms

Deep dive

Activity timeline5 mentions / 2d
01234Mentions · 2026-03-17: 1Mentions · 2026-04-02: 4Patch / Workaround · 2026-03-17: 1Patch / Workaround · 2026-04-02: 2Technical Details · 2026-03-17: 1Technical Details · 2026-04-02: 203-1704-02
Signal classification3 categories
Disclosure
360.0%
General
120.0%
Patch
120.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-03-171
Disclosure1
2026-04-024
Disclosure2General1Patch1
Full discourse5 posts
  • CyberSec Intel Alliance@CyberAlliance26
    Disclosure

    🚨 FRESH TOP THREAT ALERT (March 17, 2026): CVE-2026-34567 – Critical Unauthenticated Remote Code Execution in Fortinet FortiOS (CVSS 9.8)! Heap-based buffer overflow in the SSL VPN component lets attackers send one crafted packet and gain full control of the firewall — no login required. Hits thousands of enterprise perimeters. Remediation: Upgrade immediately to FortiOS 7.4.6+, 7.6.1+ or latest patched build via FortiGuard / auto-update and reboot. Firewall = gateway to your entire network. Patch or get breached! 🔥 #CyberSecurity #FortinetRCE #ZeroDay #FirewallSecurity

    Post summary

    The post announces a newly discovered critical remote‑code‑execution vulnerability in FortiOS, provides technical details of the flaw, and urges immediate patching by specifying affected firmware versions.

    02020133
    19 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-34567 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.… https://www.cve.org/CVERecord?id=CVE-2026-34567

    Post summary

    The text is a brief reference to a CVE record and software description, lacking details on exploitation, mitigation, or technical specifics.

    00010128
    56.9K followersView on X
  • PulsePatch.io@pulsepatchio
    Disclosure

    A stored DOM XSS vulnerability (CVE-2026-34567) in `CI4MS` Blogs Posts allows full account takeover. Review content sanitization practices and monitor for vendor patches. #XSS #WebSecurity #InfoSec https://www.pulsepatch.io/posts/cve-2026-34567-ci4ms-blog-posts-dom-xss-account-takeover

    Post summary

    The post announces a stored DOM XSS vulnerability (CVE-2026-34567) in CI4MS Blogs Posts that can lead to full account takeover and urges users to monitor for vendor patches, but it does not provide a PoC, exploitation tool, or evidence of active attacks.

    0000032
    6 followersView on X
  • CVEFind.com@CveFindCom
    Patch

    [CVE-2026-34567: CRITICAL] CodeIgniter 4-based CMS skeleton CI4MS had a cyber security vulnerability allowing stored cross-site scripting pre-version 0.31.0.0. Update to the patched version for secure usage.#cve,CVE-2026-34567,#cybersecurity https://cvefind.com/CVE-2026-34567

    Post summary

    CVE‑2026‑34567 is a critical stored XSS flaw in CI4MS versions before 0.31.0.0, with a vendor patch available and recommended to be applied.

    0000033
    617 followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🔴 CVE-2026-34567 - Critical CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fa... https://www.thehackerwire.com/vulnerability/CVE-2026-34567/ https://t.co/ZWV31yqbO6

    Post summary

    The snippet announces a critical CVE‑2026‑34567 affecting CI4MS before version 0.31.0.0, but offers no technical specifics, PoC, or remediation information.

    0000060
    163 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appci4-cms-erpci4ms---

Explore more

Back to dashboardci4-cms-erp CVEsci4ms vulnerabilities