CVE-2026-34569Disclosure(ci4-cms-erp / ci4ms)

LOWCVSS 9.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch ci4-cms-erp ci4ms systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog categories. An attacker can inject a malicious JavaScript payload into the category title field, which is then stored server-side. This stored payload is later rendered unsafely across public-facing blog category pages, administrative interfaces, and blog post views without proper output encoding, leading to stored cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.

ci4-cms-erp CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-fhrf-q333-82fm

Other references

https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ci4ms

Threat summary

Patch or workaround signal is available
5 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 4 mentions (2026-04-02); latest day: 1
5 total mentions across 2 days

Affected systems

Vendors

ci4-cms-erp

Products

ci4ms

Deep dive

Activity timeline5 mentions / 2d

Signal classification3 categories

Disclosure

360.0%

General

120.0%

Patch

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-02	4	Disclosure2General1Patch1
2026-04-03	1	Disclosure1

Full discourse5 posts

PulsePatch.io@pulsepatchio188d
Disclosure
A stored DOM XSS vulnerability (CVE-2026-34569) in `CI4MS Blogs Categories` enables account takeover and privilege escalation. Remediation requires strict input validation and output encoding. #XSS #infosec #websecurity https://www.pulsepatch.io/posts/cve-2026-34569-ci4ms-blogs-categories-dom-xss
Post summary
A stored DOM XSS flaw (CVE-2026-34569) in CI4MS Blogs Categories can lead to account takeover and privilege escalation; remediation involves enforcing strict input validation and output encoding.
0000034
10 followersView on X
CVEFind.com@CveFindCom189d
Patch
[CVE-2026-34569: CRITICAL] CI4MS, a CodeIgniter 4-based CMS, had a vulnerability allowing stored XSS through unsanitized user input in blog categories pre version 0.31.0.0. Ensure to update to the latest ver...#cve,CVE-2026-34569,#cybersecurity https://cvefind.com/CVE-2026-34569
Post summary
CI4MS is vulnerable to stored XSS via unsanitized blog category input before version 0.31.0.0; updating to the latest version fixes the issue.
0000037
617 followersView on X
CTIWatch@ctiwatchcloud189d
General
🔍 Today's Top Vulnerabilities 🔴 CVE-2026-34570 | CVSS 10.0 🔴 CVE-2026-4370 | CVSS 10.0 🔴 CVE-2026-34569 | CVSS 9.9 🔗 http://ctiwatch.cloud/vulnerabilities #CVE #Vulnerability #ThreatIntel
Post summary
The tweet lists three high‑scoring CVEs with CVSS scores but offers no additional context on exploitation, PoC, or remediation.
0000025
5.6K followersView on X
CVE@CVEnew189d
Disclosure
CVE-2026-34569 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.… https://www.cve.org/CVERecord?id=CVE-2026-34569
Post summary
The brief post references CVE-2026-34569 and identifies the affected CodeIgniter CMS skeleton, but offers no further technical, exploit, or remediation details.
00000128
56.9K followersView on X
The Hacker Wire@TheHackerWire189d
Disclosure
🔴 CVE-2026-34569 - Critical CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fa... https://www.thehackerwire.com/vulnerability/CVE-2026-34569/ https://t.co/PlmvntwDAM
Post summary
A new critical vulnerability (CVE-2026-34569) has been identified in CI4MS, a CodeIgniter 4-based CMS skeleton, with details available on The Hacker Wire.
0000060
163 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	ci4-cms-erp	ci4ms	-	-	-

Explore more

Back to dashboard ci4-cms-erp CVEs ci4ms vulnerabilities

What researchers are saying

CVE-2026-34569

PulsePatch.io@pulsepatchioDisclosure

A stored DOM XSS flaw (CVE-2026-34569) in CI4MS Blogs Categories can lead to account takeover and privilege escalation; remediation involves enforcing strict input validation and output encoding.

CVEFind.com@CveFindComPatch

CI4MS is vulnerable to stored XSS via unsanitized blog category input before version 0.31.0.0; updating to the latest version fixes the issue.

CTIWatch@ctiwatchcloudGeneral

The tweet lists three high‑scoring CVEs with CVSS scores but offers no additional context on exploitation, PoC, or remediation.

CVE@CVEnewDisclosure

The brief post references CVE-2026-34569 and identifies the affected CodeIgniter CMS skeleton, but offers no further technical, exploit, or remediation details.

The Hacker Wire@TheHackerWireDisclosure

A new critical vulnerability (CVE-2026-34569) has been identified in CI4MS, a CodeIgniter 4-based CMS skeleton, with details available on The Hacker Wire.