Kritik CVSS 9 PoC var
CVE-2026-34562: Ci4ms: siteler arası betik çalıştırma (XSS)
Açıklama (NVD)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative configuration fields accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. This issue has been patched in version 0.31.0.0.
Özet bilgiler
- Ürün
- Ci4-cms-erp Ci4ms
- CVSS v3.1
- 9
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - EPSS
- %0,28 (yüzdelik 20)
- CWE
- CWE-79
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| ci4-cms-erp-ci4ms | — | — | 0.31.0.0 |