CVE-2026-34559 - Vulnerability Analysis

Overview

CI4MS < 0.31.0.0 contains a stored cross-site scripting caused by improper sanitization of user input in blog tag creation/editing, letting attackers inject malicious JavaScript executed on public and admin pages, exploit requires user input submission.

Severity & Score

Impact

Attackers can execute malicious scripts in users' browsers, potentially stealing credentials or performing actions on behalf of users.

Mitigation

Update to version 0.31.0.0 or later.

References

• https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-4333-387x-w245

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner