Signal is active with 5 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, a Stored Cross-Site Scripting (Stored XSS) vulnerability exists in the backend user management functionality. The application fails to properly sanitize user-controlled input before rendering it in the administrative interface, allowing attackers to inject persistent JavaScript code. This results in automatic execution whenever backend users access the affected page, enabling session hijacking, privilege escalation, and full administrative account compromise. This issue has been patched in version 0.31.0.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34571 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.… https://www.cve.org/CVERecord?id=CVE-2026-34571
Post summary
The post simply links to the CVE record for CVE-2026-34571 without providing any additional technical or exploitation details.
🚨 Critical CI4MS flaw: CVE-2026-34571 A Stored XSS issue in backend user management could enable session hijacking and admin account compromise. Update immediately. 🔗 https://vulert.com/vuln-db/CVE-2026-34571 #CyberSecurity #CI4MS #StoredXSS #Vulert https://t.co/fMnVCEw4M6
Post summary
The post highlights a critical stored XSS flaw (CVE-2026-34571) in CI4MS that could lead to session hijacking and admin compromise, and urges users to apply updates immediately.
A critical stored XSS (CVE-2026-34571) in `CI4MS` backend user management allows session hijacking and admin compromise. Restrict access and monitor `CI4MS` for vendor updates. #XSS #infosec #backend https://www.pulsepatch.io/posts/cve-2026-34571-ci4ms-stored-xss
Post summary
The post discloses a critical stored XSS vulnerability (CVE‑2026‑34571) in CI4MS that could lead to session hijacking and admin compromise, and recommends restricting access and monitoring vendor updates.
[CVE-2026-34571: CRITICAL] CodeIgniter 4-based CMS skeleton CI4MS has patched a Stored Cross-Site Scripting (Stored XSS) vulnerability in backend user management. Update to version 0.31.0.0 for secure usage.#cve,CVE-2026-34571,#cybersecurity https://cvefind.com/CVE-2026-34571
Post summary
The post announces that CVE-2026-34571, a critical stored XSS flaw in the CodeIgniter 4 CMS skeleton CI4MS, has been patched, recommending users upgrade to version 0.31.0.0.
🔴 CVE-2026-34571 - Critical CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, a Stored Cross-Sit... https://www.thehackerwire.com/vulnerability/CVE-2026-34571/ https://t.co/s7ZatbZCkA
Post summary
The post announces CVE-2026-34571, a critical stored XSS vulnerability in CI4MS before version 0.31.0.0, without mentioning exploitation, PoC, or fixes.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ci4-cms-erp | ci4ms | - | - | - |