ci4-cms-erp/ci4ms
Packagist36 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting ci4-cms-erp/ci4mspage 1 of 1
- CVE-2026-25509MEDIUMCVSS 5.3EG 5.3fixed in 0.28.5.02026-02-03
vulnerable: 0.21.0 ... 0.28.4.0 (45 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, the authentication implementation in CI4MS is vulnerable to email enum…
- CVE-2026-25510HIGHCVSS 8.8EG 8.8fixed in 0.28.5.02026-02-03
vulnerable: 0.21.0 ... 0.28.4.0 (45 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, an authenticated user with file editor permissions can achieve Remote …
- CVE-2026-27599HIGHCVSS 7.2EG 7.2fixed in 0.31.0.02026-03-30
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input withi…
- CVE-2026-34557CRITICALCVSS 9.0EG 9.0fixed in 0.31.0.02026-03-30
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input withi…
- CVE-2026-34558CRITICALCVSS 9.0EG 9.0fixed in 0.31.0.02026-03-30
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input withi…
- CVE-2026-34559CRITICALCVSS 9.1EG 9.1fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when …
- CVE-2026-34560CRITICALCVSS 9.1EG 9.1fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application renders user-controlled input unsafely within the logs…
- CVE-2026-34561MEDIUMCVSS 4.7EG 4.7fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input withi…
- CVE-2026-34562MEDIUMCVSS 4.7EG 4.7fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input withi…
- CVE-2026-34563CRITICALCVSS 9.1EG 9.1fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when …
- CVE-2026-34564CRITICALCVSS 9.1EG 9.1fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when …
- CVE-2026-34565CRITICALCVSS 9.1EG 9.1fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when …
- CVE-2026-34566CRITICALCVSS 9.1EG 9.1fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input withi…
- CVE-2026-34567CRITICALCVSS 9.1EG 9.1fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when …
- CVE-2026-34568CRITICALCVSS 9.1EG 9.1fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when …
- CVE-2026-34569CRITICALCVSS 9.9EG 9.9fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when …
- CVE-2026-34570HIGHCVSS 8.8EG 8.8fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when …
- CVE-2026-34571CRITICALCVSS 9.9EG 9.9fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, a Stored Cross-Site Scripting (Stored XSS) vulnerability exists in the…
- CVE-2026-34572HIGHCVSS 8.8EG 8.8fixed in 0.31.0.02026-04-01
vulnerable: 0.21.0 ... 0.28.6.0 (47 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when …
- CVE-2026-34989CRITICALCVSS 9.0EG 9.0fixed in 31.0.0.02026-04-06
vulnerable: 0.21.0 ... 0.35.0.0 (65 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 31.0.0.0, the application fails to properly sanitize user-controlled input when users up…
- CVE-2026-35035HIGHCVSS 7.2EG 7.2fixed in 0.31.2.02026-04-06
vulnerable: 0.21.0 ... 0.31.1.0 (49 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.2.0, the application fails to properly sanitize user-controlled input within System…
- CVE-2026-39389HIGHCVSS 7.2EG 7.2fixed in 0.31.4.02026-04-08
vulnerable: 0.21.0 ... 0.31.3.0 (51 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, This vulnerability is fixed in 0.31.4.0.
- CVE-2026-39390MEDIUMCVSS 4.8EG 4.8fixed in 0.31.4.02026-04-08
vulnerable: 0.21.0 ... 0.31.3.0 (51 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Google Maps iframe setting (cMap field) in compInfosPost() sanitizes input…
- CVE-2026-39391MEDIUMCVSS 4.8EG 4.8fixed in 0.31.4.02026-04-08
vulnerable: 0.21.0 ... 0.31.3.0 (51 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the blacklist (ban) note parameter in UserController::ajax_blackList_post() is…
- CVE-2026-39392MEDIUMCVSS 4.8EG 4.8fixed in 0.31.4.02026-04-08
vulnerable: 0.21.0 ... 0.31.3.0 (51 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Pages module does not apply the html_purify validation rule to content fie…
- CVE-2026-39393HIGHCVSS 8.1EG 8.1fixed in 0.31.4.02026-04-08
vulnerable: 0.21.0 ... 0.31.3.0 (51 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check (cach…
- CVE-2026-39394CRITICALCVSS 9.8EG 9.8fixed in 0.31.4.02026-04-08
vulnerable: 0.21.0 ... 0.31.3.0 (51 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Install::index() controller reads the host POST parameter without any vali…
- CVE-2026-41201CRITICALCVSS 9.1EG 9.1fixed in 0.31.5.02026-05-07
vulnerable: 0.21.0 ... 0.31.4.0 (52 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. In version 0.31.4.0, an attacker can achieve Full Account Takeover & Privilege Escalation via Sto…
- CVE-2026-41202CRITICALCVSS 9.4EG 9.4fixed in 0.31.5.02026-05-07
vulnerable: 0.21.0 ... 0.31.4.0 (52 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.5.0, ci4ms Backup::restore extracts user uploaded ZIP archives without vali…
- CVE-2026-41203CRITICALCVSS 9.4EG 9.4fixed in 0.31.5.02026-05-07
vulnerable: 0.21.0 ... 0.31.4.0 (52 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.5.0, ci4ms Theme::upload extracts user uploaded ZIP archives without valida…
- CVE-2026-41587HIGHCVSS 8.6EG 8.6fixed in 0.31.7.02026-05-07
vulnerable: 0.26.0.0 ... 0.31.6.0 (21 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0.0 to before version 0.31.7.0, a theme upload feature allows any authenticated…
- CVE-2026-41890MEDIUMCVSS 6.9EG 6.9fixed in 0.31.8.02026-05-07
vulnerable: 0.31.1.0 ... 0.31.7.0 (7 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.31.1.0 to before version 0.31.8.0, the deleteProcess() action accepts a POST param…
- CVE-2026-41891MEDIUMCVSS 5.3EG 5.3fixed in 0.31.8.02026-05-07
vulnerable: 0.26.0.0 ... 0.31.7.0 (22 versions)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0 to before version 0.31.8.0, the auth filter has the deactivated/banned user c…
- CVE-2026-45138MEDIUMCVSS 5.4EG 5.4fixed in 0.31.9.02026-05-18
vulnerable: 0.21.0 ... 0.31.9 (57 versions)
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (`?string &$str`), but CodeIgniter 4's…
- CVE-2026-45139MEDIUMCVSS 6.5EG 6.5fixed in 0.31.9.02026-05-18
vulnerable: 0.21.0 ... 0.31.9 (57 versions)
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on content-write operations (`saveFile`, `c…
- CVE-2026-45270HIGHCVSS 8.7EG 8.7fixed in 0.31.9.02026-05-18
vulnerable: 0.21.0 ... 0.31.9 (57 versions)
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html_purify` validation rule on language-keyed page content but persists the raw, un-purified POST valu…
Check whether ci4-cms-erp/ci4ms is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for ci4-cms-erp/ci4ms CVEs against the assets you own.
Book a Demo →