CVE-2026-35035General(ci4-cms-erp / ci4ms)

LOWCVSS 9.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch ci4-cms-erp ci4ms systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.2.0, the application fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative configuration fields accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. These values are persisted in the database and rendered unsafely on public-facing pages only, such as the main landing page. There is no execution in the administrative dashboard—the vulnerability only impacts the public frontend. This vulnerability is fixed in 0.31.2.0.

ci4-cms-erp CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ci4ms

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-04-06); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

ci4-cms-erp

Products

ci4ms

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

General

150.0%

Disclosure

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-06	1	General1
2026-04-11	1	Disclosure1

Full discourse2 posts

PulsePatch.io@pulsepatchio182d
Disclosure
A stored DOM XSS vulnerability (CVE-2026-35035) in `CI4MS` allows for full platform compromise and account takeover. Review system settings and monitor vendor advisories. #XSS #Security #CVE https://www.pulsepatch.io/posts/cve-2026-35035-ci4ms-stored-dom-xss
Post summary
The tweet announces a stored DOM XSS vulnerability (CVE‑2026‑35035) in CI4MS that could enable full platform compromise and account takeover, urging users to review settings and watch vendor advisories.
0000054
11 followersView on X
CVE@CVEnew187d
General
CVE-2026-35035 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.2.0 , the … https://www.cve.org/CVERecord?id=CVE-2026-35035
Post summary
The post only references CVE‑2026‑35035 and links to the CVE record, offering no further technical, exploit, or mitigation details.
00000120
57.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	ci4-cms-erp	ci4ms	-	-	-

Explore more

Back to dashboard ci4-cms-erp CVEs ci4ms vulnerabilities