Skip to content
Noroxi

ci4-cms-erp records

27 published records for vendor ci4-cms-erp.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
100%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

27 records
  • CVE-2026-39394
    39Monitor

    CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller

    CriticalCVSS 9.8No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 8, 2026

  • CVE-2026-34989
    37Monitor

    CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    CriticalCVSS 9.4No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 6, 2026

  • CVE-2026-35035
    36Monitor

    CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company I

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 6, 2026

  • CVE-2026-34571
    36Monitor

    CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-34560
    36Monitor

    CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-34559
    36Monitor

    CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-34569
    36Monitor

    CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-34568
    36Monitor

    CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-34557
    36Monitor

    CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msMar 30, 2026

  • CVE-2026-34558
    36Monitor

    CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msMar 30, 2026

  • CVE-2026-34564
    36Monitor

    CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-34562
    36Monitor

    CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-34567
    36Monitor

    CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-34563
    36Monitor

    CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-34565
    36Monitor

    CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-34566
    36Monitor

    CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    CriticalCVSS 9.0No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-25510
    35Monitor

    CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor

    HighCVSS 8.8No exploitEPSS 0%

    ci4-cms-erp · ci4msFeb 3, 2026

  • CVE-2026-34572
    35Monitor

    CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

    HighCVSS 8.8No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-34570
    35Monitor

    CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

    HighCVSS 8.8No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-34561
    33Monitor

    CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    HighCVSS 8.4No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 1, 2026

  • CVE-2026-39393
    32Monitor

    Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms

    HighCVSS 8.1No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 8, 2026

  • CVE-2026-39389
    28Monitor

    CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files

    HighCVSS 7.2No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 8, 2026

  • CVE-2026-27599
    28Monitor

    CI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    HighCVSS 7.2No exploitEPSS 0%

    ci4-cms-erp · ci4msMar 30, 2026

  • CVE-2026-25509
    21Monitor

    CI4MS Vulnerable to User Email Enumeration via Password Reset Flow

    MediumCVSS 5.3No exploitEPSS 0%

    ci4-cms-erp · ci4msFeb 3, 2026

  • CVE-2026-39392
    19Monitor

    CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization

    MediumCVSS 4.8No exploitEPSS 0%

    ci4-cms-erp · ci4msApr 8, 2026