CVE-2026-34565 - Vulnerability Analysis

Overview

CI4MS < 0.31.0.0 contains a stored XSS caused by improper sanitization and output encoding of user-controlled post data in Menu Management, letting attackers execute scripts in admin and public dashboards, exploit requires adding posts to navigation menus.

Severity & Score

Impact

Attackers can execute arbitrary scripts in admin and public dashboards, potentially leading to session hijacking or unauthorized actions.

Mitigation

Update to version 0.31.0.0 or later.

References

• https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-xgh5-w62m-8mpr

Social Media Activity(1 post)

OffSequence

@offseq

Apr 2, 2026

⚠️ CRITICAL: CVE-2026-34565 in ci4ms (<0.31.0.0) enables persistent XSS via menu management. Low-priv users can inject scripts impacting admins & users. Upgrade to 0.31.0.0+ now! https://radar.offseq.com/threat/cve-2026-34565-cwe-79-improper-neutralization-of-i-f662be7e #OffSeq #XSS #WebSecurity

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner