CVEs we hold for Ci4-cms-erp

Records whose assigning authority named Ci4-cms-erp as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-45270CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Ruleci4-cms-erp ci4ms

CVE-2026-45139CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on…ci4-cms-erp ci4ms

CVE-2026-45138CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Ruleci4-cms-erp ci4ms

CVE-2026-41891CI4MS: Deactivated User Session Bypass (active=0)ci4-cms-erp ci4ms

CVE-2026-41890CI4MS: Arbitrary Database Table Drop via Theme deleteProcessci4-cms-erp ci4ms

CVE-2026-41587CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Executionci4-cms-erp ci4ms

CVE-2026-41203ci4ms Theme::upload is vulnerable to Zip Slip leading to RCEci4-cms-erp ci4ms

CVE-2026-41202ci4ms Backup::restore is vulnerable to Zip Slip leading to RCEci4-cms-erp ci4ms

CVE-2026-41201CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2ci4-cms-erp ci4ms

CVE-2026-39394CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controllerci4-cms-erp ci4ms

CVE-2026-39393Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4msci4-cms-erp ci4ms

CVE-2026-39392CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitizationci4-cms-erp ci4ms

CVE-2026-39391CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User Listci4-cms-erp ci4ms

CVE-2026-39390CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe settingci4-cms-erp ci4ms

CVE-2026-39389CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Filesci4-cms-erp ci4ms

CVE-2026-35035CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles &…ci4-cms-erp ci4ms

CVE-2026-34989CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM…ci4-cms-erp ci4ms

CVE-2026-34572CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation…ci4-cms-erp ci4ms

CVE-2026-34571CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full…ci4-cms-erp ci4ms

CVE-2026-34570CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation…ci4-cms-erp ci4ms

CVE-2026-34569CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms

CVE-2026-34568CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms

CVE-2026-34567CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms

CVE-2026-34566CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms

CVE-2026-34565CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms

CVE-2026-34564CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms

CVE-2026-34563CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSSci4-cms-erp ci4ms

CVE-2026-34562CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles &…ci4-cms-erp ci4ms

CVE-2026-34561CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles &…ci4-cms-erp ci4ms

CVE-2026-34560CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms

CVE-2026-34559CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms

CVE-2026-34558CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms

CVE-2026-34557CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSci4-cms-erp ci4ms

CVE-2026-27599CI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles &…ci4-cms-erp ci4ms

CVE-2026-25510CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editorci4-cms-erp ci4ms

CVE-2026-25509CI4MS Vulnerable to User Email Enumeration via Password Reset Flowci4-cms-erp ci4ms

36 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.