CVE-2026-34568 - Vulnerability Analysis

Overview

CI4MS < 0.31.0.0 contains a stored cross-site scripting caused by improper sanitization of user input in blog post content, letting attackers inject malicious JavaScript payloads that execute in other users' browsers, exploit requires crafted blog post content.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in users' browsers, potentially stealing cookies or performing actions on behalf of users.

Mitigation

Update to version 0.31.0.0 or later.

References

• https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-x7wh-g25g-53vg

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner