CVE-2026-39391: fallo de gravedad media en ci4-cms-erp ci4ms
CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.8epss 0.2%
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the blacklist (ban) note parameter in UserController::ajax_blackList_post() is stored in the database without sanitization and rendered into an HTML data-note attribute without escaping. An admin with blacklist privileges can inject arbitrary JavaScript that executes in the browser of any other admin who views the user management page. This vulnerability is fixed in 0.31.4.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Productos afectados
ci4-cms-erp · ci4msCVEs relacionadas — ci4-cms-erp ci4ms
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-25510CRITICALCI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File EditorEPSS 0.9%CVE-2026-41202CRITICALci4ms Backup::restore is vulnerable to Zip Slip leading to RCEEPSS 0.7%CVE-2026-41587HIGHCI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code ExecutionEPSS 0.6%CVE-2026-41203CRITICALci4ms Theme::upload is vulnerable to Zip Slip leading to RCEEPSS 0.6%CVE-2026-39394HIGHCI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install ControllerEPSS 0.5%CVE-2026-34572HIGHCI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)EPSS 0.5%