Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.31.1.0 to before version 0.31.8.0, the deleteProcess() action accepts a POST parameter tables[] containing arbitrary table names. These are passed directly to $forge->dropTable() without validating that the tables belong to the theme being deleted. The deleteConfirm view correctly populates tables[] from the theme's own migration files, but the server-side deleteProcess does not verify the received values against those files. An authenticated admin can craft a POST request with arbitrary table names and drop any table in the database. This issue has been patched in version 0.31.8.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-41890 SQL Injection Vulnerability in CI4MS CodeIgniter 4 CMS Versions 0.31.1.0-0.31.7.x https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41890
Post summary
The text announces a SQL injection vulnerability (CVE-2026-41890) affecting specific CI4MS CodeIgniter 4 CMS versions, providing basic technical details and a reference link.
⚡ New CVE Alert: CVE-2026-41890 📊 Severity: 6.9 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-41890 #CVE-2026-41890 #CVE #Medium #CyberSecurity #InfoSec https://t.co/sIqxbeJfY1
Post summary
The tweet merely announces CVE-2026-41890, stating a 6.9 severity score and medium risk, that it affects multiple unspecified products, and provides a link to the NVD entry for further details.
CVE-2026-41890 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.31.1.0 to… https://www.cve.org/CVERecord?id=CVE-2026-41890
Post summary
The text merely references CVE‑2026‑41890 with a short product description and a link to the CVE record, offering no substantive details about the vulnerability or its exploitation.