CVE-2026-34571

216.73.217.22

· Published 01/04/2026 22:16 · Modified 02/04/2026 17:16

Labels: CVE-2026-34571 2026-04-01 CVE-2026-34571 CWE-79 [email protected]

Essential information

Published: 01/04/2026 22:16
Modified: 02/04/2026 17:16
Author: —
Creator: —
CVSS: 9.9 CRITICAL (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS metrics

Description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, a Stored Cross-Site Scripting (Stored XSS) vulnerability exists in the backend user management functionality. The application fails to properly sanitize user-controlled input before rendering it in the administrative interface, allowing attackers to inject persistent JavaScript code. This results in automatic execution whenever backend users access the affected page, enabling session hijacking, privilege escalation, and full administrative account compromise. This issue has been patched in version 0.31.0.0.

NVD status

Status: Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
codeigniter / ci4ms	`cpe:2.3:a:codeigniter:ci4ms:<0.31.0.0:::::::*`