CVE-2026-34566 - Vulnerability Analysis

Overview

CI4MS < 0.31.0.0 contains a stored XSS caused by improper sanitization of user input in Page Management, letting attackers inject JavaScript payloads that execute in admin and public views, exploit requires crafted input.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in admin and public pages, leading to session hijacking or unauthorized actions.

Mitigation

Update to version 0.31.0.0 or later.

References

• https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-458r-h248-29c5

Social Media Activity(1 post)

OffSequence

@offseq

Apr 2, 2026

🚨 CVE-2026-34566: Critical stored XSS (CVSS 9.1) in ci4ms < 0.31.0.0. Attackers can inject persistent JS via Page Management, impacting admins & users. Upgrade to 0.31.0.0+, audit content, enable CSP. Details: https://radar.offseq.com/threat/cve-2026-34566-cwe-79-improper-neutralization-of-i-937ed996 #OffSeq #XSS #Vuln #Infosec

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner