CVE-2026-34567 - Vulnerability Analysis

Overview

CI4MS < 0.31.0.0 contains a stored cross-site scripting caused by improper sanitization of user input in Categories content, letting attackers inject malicious JavaScript payloads executed when viewing blog posts, exploit requires user interaction.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in users' browsers, potentially stealing credentials or performing actions on behalf of users.

Mitigation

Update to version 0.31.0.0 or later.

References

• https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-r33w-c82v-x5v7

Social Media Activity(1 post)

OffSequence

@offseq

Apr 2, 2026

CRITICAL: CVE-2026-34567 in ci4ms (<0.31.0.0) enables stored XSS via blog categories. Attackers can hijack sessions or steal data. Upgrade to 0.31.0.0 ASAP & audit for injected scripts. https://radar.offseq.com/threat/cve-2026-34567-cwe-79-improper-neutralization-of-i-5c12fe3e #OffSeq #XSS #InfoSec #CVE202634567

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner