{"schema_version":1,"title":"ci4-cms-erp/ci4ms (Packagist) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 36 vulnerabilities in ci4-cms-erp/ci4ms (Packagist): 0 in the last 7 days and 3 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-45270, was published on 20 July 2026.","url":"https://junglewise.ai/threats/technologies/ci4-cms-erp-ci4ms","json_url":"https://junglewise.ai/threats/technologies/ci4-cms-erp-ci4ms.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/ci4-cms-erp-ci4ms","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":4,"all_time":36,"critical":3,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":3,"last_365_days":36},"latest":[{"cve":"CVE-2026-45270","cvss":8.7,"epss":0.0037,"slug":"cve-2026-45270-ci4-cms-erp-ci4ms-stored-xss-in-pages-module","title":"ci4-cms-erp CI4MS stored XSS in Pages module","severity":"high","exploited":false,"published_at":"2026-07-20T15:16:38.163+00:00","url":"https://junglewise.ai/threats/cve-2026-45270-ci4-cms-erp-ci4ms-stored-xss-in-pages-module"},{"cve":"CVE-2026-45139","cvss":6.5,"epss":0.0048,"slug":"cve-2026-45139-ci4-cms-erp-ci4ms-file-deletion-and-rename-in-fileeditor-module","title":"ci4-cms-erp CI4MS file deletion and rename in Fileeditor module","severity":"medium","exploited":false,"published_at":"2026-07-20T15:16:38.02+00:00","url":"https://junglewise.ai/threats/cve-2026-45139-ci4-cms-erp-ci4ms-file-deletion-and-rename-in-fileeditor-module"},{"cve":"CVE-2026-45138","cvss":5.4,"epss":0.0024,"slug":"cve-2026-45138-ci4-cms-erp-ci4ms-stored-xss-in-blog-and-pages-content","title":"ci4-cms-erp ci4ms stored XSS in Blog and Pages content","severity":"medium","exploited":false,"published_at":"2026-07-20T00:16:58.363+00:00","url":"https://junglewise.ai/threats/cve-2026-45138-ci4-cms-erp-ci4ms-stored-xss-in-blog-and-pages-content"},{"cve":"CVE-2026-41891","cvss":4,"epss":0.0036,"slug":"cve-2026-41891-ci4ms-has-a-deactivated-user-session-bypass-active-0","title":"CI4MS has a Deactivated User Session Bypass (active=0)","severity":"medium","exploited":false,"published_at":"2026-05-04T20:50:55+00:00","url":"https://junglewise.ai/threats/cve-2026-41891-ci4ms-has-a-deactivated-user-session-bypass-active-0"},{"cve":"CVE-2026-41890","cvss":4,"epss":0.0043,"slug":"cve-2026-41890-ci4ms-vulnerable-to-arbitrary-database-table-drop-via-theme","title":"CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess","severity":"medium","exploited":false,"published_at":"2026-05-04T20:50:10+00:00","url":"https://junglewise.ai/threats/cve-2026-41890-ci4ms-vulnerable-to-arbitrary-database-table-drop-via-theme"},{"cve":"CVE-2026-41587","cvss":4,"epss":0.0068,"slug":"cve-2026-41587-ci4ms-has-unrestricted-php-file-upload-via-theme-installation","title":"CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution","severity":"medium","exploited":false,"published_at":"2026-04-29T20:42:44+00:00","url":"https://junglewise.ai/threats/cve-2026-41587-ci4ms-has-unrestricted-php-file-upload-via-theme-installation"},{"cve":"CVE-2026-41203","cvss":4,"epss":0.0072,"slug":"cve-2026-41203-ci4ms-theme-upload-is-vulnerable-to-zip-slip-leading-to-rce","title":"CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE","severity":"medium","exploited":false,"published_at":"2026-04-22T17:29:58+00:00","url":"https://junglewise.ai/threats/cve-2026-41203-ci4ms-theme-upload-is-vulnerable-to-zip-slip-leading-to-rce"},{"cve":"CVE-2026-41202","cvss":4,"epss":0.0072,"slug":"cve-2026-41202-ci4ms-backup-restore-is-vulnerable-to-zip-slip-leading-to-rce","title":"CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE","severity":"medium","exploited":false,"published_at":"2026-04-22T17:28:39+00:00","url":"https://junglewise.ai/threats/cve-2026-41202-ci4ms-backup-restore-is-vulnerable-to-zip-slip-leading-to-rce"},{"cve":"CVE-2026-41201","cvss":3.1,"epss":0.0056,"slug":"cve-2026-41201-ci4ms-backup-management-full-account-takeover-for-all-roles","title":"CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS","severity":"low","exploited":false,"published_at":"2026-04-22T17:27:46+00:00","url":"https://junglewise.ai/threats/cve-2026-41201-ci4ms-backup-management-full-account-takeover-for-all-roles"},{"cve":"CVE-2026-39394","cvss":8.1,"epss":0.0051,"slug":"cve-2026-39394-ci4-cms-erp-ci4ms-crlf-injection-in-install-controller","title":"ci4-cms-erp CI4MS CRLF injection in Install controller","severity":"high","exploited":false,"published_at":"2026-04-08T15:16:14.36+00:00","url":"https://junglewise.ai/threats/cve-2026-39394-ci4-cms-erp-ci4ms-crlf-injection-in-install-controller"},{"cve":"CVE-2026-39393","cvss":8.1,"epss":0.0041,"slug":"cve-2026-39393-ci4-cms-erp-ci4ms-authentication-bypass-in-installation-wizard","title":"ci4-cms-erp CI4MS authentication bypass in installation wizard","severity":"high","exploited":false,"published_at":"2026-04-08T15:16:14.21+00:00","url":"https://junglewise.ai/threats/cve-2026-39393-ci4-cms-erp-ci4ms-authentication-bypass-in-installation-wizard"},{"cve":"CVE-2026-39392","cvss":5.5,"epss":0.0025,"slug":"cve-2026-39392-ci4-cms-erp-ci4ms-stored-xss-in-pages-module","title":"ci4-cms-erp CI4MS stored XSS in Pages module","severity":"medium","exploited":false,"published_at":"2026-04-08T15:16:14.057+00:00","url":"https://junglewise.ai/threats/cve-2026-39392-ci4-cms-erp-ci4ms-stored-xss-in-pages-module"},{"cve":"CVE-2026-39391","cvss":4.8,"epss":0.0025,"slug":"cve-2026-39391-ci4-cms-erp-ci4ms-stored-xss-in-usercontroller-blacklist-note","title":"ci4-cms-erp CI4MS stored XSS in UserController blacklist note","severity":"medium","exploited":false,"published_at":"2026-04-08T15:16:13.897+00:00","url":"https://junglewise.ai/threats/cve-2026-39391-ci4-cms-erp-ci4ms-stored-xss-in-usercontroller-blacklist-note"},{"cve":"CVE-2026-39390","cvss":5.5,"epss":0.0024,"slug":"cve-2026-39390-ci4-cms-erp-ci4ms-stored-xss-in-google-maps-iframe-setting","title":"ci4-cms-erp CI4MS stored XSS in Google Maps iframe setting","severity":"medium","exploited":false,"published_at":"2026-04-08T15:16:13.75+00:00","url":"https://junglewise.ai/threats/cve-2026-39390-ci4-cms-erp-ci4ms-stored-xss-in-google-maps-iframe-setting"},{"cve":"CVE-2026-39389","cvss":6.7,"epss":0.0049,"slug":"cve-2026-39389-ci4-cms-erp-ci4ms-authorization-bypass-in-fileeditor","title":"ci4-cms-erp CI4MS authorization bypass in Fileeditor","severity":"medium","exploited":false,"published_at":"2026-04-08T15:16:13.587+00:00","url":"https://junglewise.ai/threats/cve-2026-39389-ci4-cms-erp-ci4ms-authorization-bypass-in-fileeditor"},{"cve":"CVE-2026-35035","cvss":3.1,"epss":0.0056,"slug":"cve-2026-35035-ci4ms-company-information-public-facing-page-full-platform","title":"CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via Syst","severity":"low","exploited":false,"published_at":"2026-04-06T17:53:02+00:00","url":"https://junglewise.ai/threats/cve-2026-35035-ci4ms-company-information-public-facing-page-full-platform"},{"cve":"CVE-2026-34989","cvss":3.1,"epss":0.0045,"slug":"cve-2026-34989-ci4ms-profile-user-management-full-account-takeover-for-all-roles","title":"CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS","severity":"low","exploited":false,"published_at":"2026-04-03T04:00:57+00:00","url":"https://junglewise.ai/threats/cve-2026-34989-ci4ms-profile-user-management-full-account-takeover-for-all-roles"},{"cve":"CVE-2026-34572","cvss":8.8,"epss":0.0065,"slug":"cve-2026-34572-ci4ms-account-deactivation-module-grants-full-persistent","title":"CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)","severity":"high","exploited":false,"published_at":"2026-04-01T22:09:39+00:00","url":"https://junglewise.ai/threats/cve-2026-34572-ci4ms-account-deactivation-module-grants-full-persistent"},{"cve":"CVE-2026-34571","cvss":3.1,"epss":0.0056,"slug":"cve-2026-34571-ci4ms-stored-cross-site-scripting-stored-xss-in-backend-user","title":"CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromi","severity":"low","exploited":false,"published_at":"2026-04-01T22:09:03+00:00","url":"https://junglewise.ai/threats/cve-2026-34571-ci4ms-stored-cross-site-scripting-stored-xss-in-backend-user"},{"cve":"CVE-2026-34570","cvss":3.1,"epss":0.0065,"slug":"cve-2026-34570-ci4ms-account-deletion-module-grants-full-persistent-unauthorized","title":"CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)","severity":"low","exploited":false,"published_at":"2026-04-01T22:08:29+00:00","url":"https://junglewise.ai/threats/cve-2026-34570-ci4ms-account-deletion-module-grants-full-persistent-unauthorized"},{"cve":"CVE-2026-34569","cvss":3.1,"epss":0.0046,"slug":"cve-2026-34569-ci4ms-blogs-categories-full-account-takeover-for-all-roles","title":"CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS","severity":"low","exploited":false,"published_at":"2026-04-01T22:07:37+00:00","url":"https://junglewise.ai/threats/cve-2026-34569-ci4ms-blogs-categories-full-account-takeover-for-all-roles"},{"cve":"CVE-2026-34568","cvss":3.1,"epss":0.0039,"slug":"cve-2026-34568-ci4ms-blogs-posts-full-account-takeover-for-all-roles-privilege","title":"CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS","severity":"low","exploited":false,"published_at":"2026-04-01T22:07:13+00:00","url":"https://junglewise.ai/threats/cve-2026-34568-ci4ms-blogs-posts-full-account-takeover-for-all-roles-privilege"},{"cve":"CVE-2026-34567","cvss":3.1,"epss":0.0039,"slug":"cve-2026-34567-ci4ms-blogs-posts-categories-full-account-takeover-for-all-roles","title":"CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS","severity":"low","exploited":false,"published_at":"2026-04-01T22:06:50+00:00","url":"https://junglewise.ai/threats/cve-2026-34567-ci4ms-blogs-posts-categories-full-account-takeover-for-all-roles"},{"cve":"CVE-2026-34566","cvss":3.1,"epss":0.0039,"slug":"cve-2026-34566-ci4ms-pages-management-full-account-takeover-for-all-roles","title":"CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS","severity":"low","exploited":false,"published_at":"2026-04-01T22:06:28+00:00","url":"https://junglewise.ai/threats/cve-2026-34566-ci4ms-pages-management-full-account-takeover-for-all-roles"},{"cve":"CVE-2026-34565","cvss":3.1,"epss":0.0039,"slug":"cve-2026-34565-ci4ms-menu-management-posts-full-account-takeover-for-all-roles","title":"CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS","severity":"low","exploited":false,"published_at":"2026-04-01T22:05:45+00:00","url":"https://junglewise.ai/threats/cve-2026-34565-ci4ms-menu-management-posts-full-account-takeover-for-all-roles"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"wwbn/avideo (Packagist)","slug":"wwbn-avideo","vulnerabilities":169,"url":"https://junglewise.ai/threats/technologies/wwbn-avideo"},{"name":"getgrav/grav (Packagist)","slug":"getgrav-grav","vulnerabilities":144,"url":"https://junglewise.ai/threats/technologies/getgrav-grav"},{"name":"thorsten/phpmyfaq (Packagist)","slug":"thorsten-phpmyfaq","vulnerabilities":138,"url":"https://junglewise.ai/threats/technologies/thorsten-phpmyfaq"},{"name":"pimcore/pimcore (Packagist)","slug":"pimcore-pimcore","vulnerabilities":136,"url":"https://junglewise.ai/threats/technologies/pimcore-pimcore"},{"name":"dolibarr/dolibarr (Packagist)","slug":"dolibarr-dolibarr","vulnerabilities":125,"url":"https://junglewise.ai/threats/technologies/dolibarr-dolibarr"},{"name":"drupal/core (Packagist)","slug":"packagist-drupal-core","vulnerabilities":116,"url":"https://junglewise.ai/threats/technologies/packagist-drupal-core"},{"name":"librenms/librenms (Packagist)","slug":"librenms-librenms","vulnerabilities":113,"url":"https://junglewise.ai/threats/technologies/librenms-librenms"},{"name":"microweber/microweber (Packagist)","slug":"microweber-microweber","vulnerabilities":106,"url":"https://junglewise.ai/threats/technologies/microweber-microweber"},{"name":"concrete5/concrete5 (Packagist)","slug":"concrete5-concrete5","vulnerabilities":93,"url":"https://junglewise.ai/threats/technologies/concrete5-concrete5"},{"name":"craftcms/cms (Packagist)","slug":"craftcms-cms","vulnerabilities":90,"url":"https://junglewise.ai/threats/technologies/craftcms-cms"},{"name":"snipe/snipe-it (Packagist)","slug":"snipe-snipe-it","vulnerabilities":80,"url":"https://junglewise.ai/threats/technologies/snipe-snipe-it"},{"name":"phpmyfaq/phpmyfaq (Packagist)","slug":"phpmyfaq-phpmyfaq","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq"}],"technology":{"hub":true,"name":"ci4-cms-erp/ci4ms (Packagist)","slug":"ci4-cms-erp-ci4ms","vendor":{"name":"Packagist","slug":"packagist","url":"https://junglewise.ai/threats/vendors/packagist"},"aliases":[],"homepage":"https://github.com/ci4ms/ci4ms","repo_url":"https://github.com/ci4-cms-erp/ci4ms","description":"An open-source content management system and enterprise resource planning tool built on the CodeIgniter 4 framework.","url":"https://junglewise.ai/threats/technologies/ci4-cms-erp-ci4ms"},"most_severe":[{"cve":"CVE-2026-34563","cvss":9.9,"epss":0.0039,"slug":"cve-2026-34563-ci4ms-backup-management-full-account-takeover-for-all-roles","title":"CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS","severity":"critical","exploited":false,"published_at":"2026-04-01T22:04:21+00:00","url":"https://junglewise.ai/threats/cve-2026-34563-ci4ms-backup-management-full-account-takeover-for-all-roles"},{"cve":"CVE-2026-27599","cvss":9.1,"epss":0.0042,"slug":"cve-2026-27599-ci4-cms-erp-ci4ms-system-settings-mail-settings-full-platform","title":"ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS","severity":"critical","exploited":false,"published_at":"2026-03-30T16:19:05+00:00","url":"https://junglewise.ai/threats/cve-2026-27599-ci4-cms-erp-ci4ms-system-settings-mail-settings-full-platform"},{"cve":"CVE-2026-34561","cvss":9.1,"epss":0.0035,"slug":"cve-2026-34561-ci4ms-system-settings-social-media-management-full-platform","title":"CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS","severity":"critical","exploited":false,"published_at":"2026-04-01T22:02:34+00:00","url":"https://junglewise.ai/threats/cve-2026-34561-ci4ms-system-settings-social-media-management-full-platform"},{"cve":"CVE-2026-34572","cvss":8.8,"epss":0.0065,"slug":"cve-2026-34572-ci4ms-account-deactivation-module-grants-full-persistent","title":"CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)","severity":"high","exploited":false,"published_at":"2026-04-01T22:09:39+00:00","url":"https://junglewise.ai/threats/cve-2026-34572-ci4ms-account-deactivation-module-grants-full-persistent"},{"cve":"CVE-2026-45270","cvss":8.7,"epss":0.0037,"slug":"cve-2026-45270-ci4-cms-erp-ci4ms-stored-xss-in-pages-module","title":"ci4-cms-erp CI4MS stored XSS in Pages module","severity":"high","exploited":false,"published_at":"2026-07-20T15:16:38.163+00:00","url":"https://junglewise.ai/threats/cve-2026-45270-ci4-cms-erp-ci4ms-stored-xss-in-pages-module"},{"cve":"CVE-2026-39394","cvss":8.1,"epss":0.0051,"slug":"cve-2026-39394-ci4-cms-erp-ci4ms-crlf-injection-in-install-controller","title":"ci4-cms-erp CI4MS CRLF injection in Install controller","severity":"high","exploited":false,"published_at":"2026-04-08T15:16:14.36+00:00","url":"https://junglewise.ai/threats/cve-2026-39394-ci4-cms-erp-ci4ms-crlf-injection-in-install-controller"},{"cve":"CVE-2026-39393","cvss":8.1,"epss":0.0041,"slug":"cve-2026-39393-ci4-cms-erp-ci4ms-authentication-bypass-in-installation-wizard","title":"ci4-cms-erp CI4MS authentication bypass in installation wizard","severity":"high","exploited":false,"published_at":"2026-04-08T15:16:14.21+00:00","url":"https://junglewise.ai/threats/cve-2026-39393-ci4-cms-erp-ci4ms-authentication-bypass-in-installation-wizard"},{"cve":"CVE-2026-39389","cvss":6.7,"epss":0.0049,"slug":"cve-2026-39389-ci4-cms-erp-ci4ms-authorization-bypass-in-fileeditor","title":"ci4-cms-erp CI4MS authorization bypass in Fileeditor","severity":"medium","exploited":false,"published_at":"2026-04-08T15:16:13.587+00:00","url":"https://junglewise.ai/threats/cve-2026-39389-ci4-cms-erp-ci4ms-authorization-bypass-in-fileeditor"},{"cve":"CVE-2026-45139","cvss":6.5,"epss":0.0048,"slug":"cve-2026-45139-ci4-cms-erp-ci4ms-file-deletion-and-rename-in-fileeditor-module","title":"ci4-cms-erp CI4MS file deletion and rename in Fileeditor module","severity":"medium","exploited":false,"published_at":"2026-07-20T15:16:38.02+00:00","url":"https://junglewise.ai/threats/cve-2026-45139-ci4-cms-erp-ci4ms-file-deletion-and-rename-in-fileeditor-module"},{"cve":"CVE-2026-39392","cvss":5.5,"epss":0.0025,"slug":"cve-2026-39392-ci4-cms-erp-ci4ms-stored-xss-in-pages-module","title":"ci4-cms-erp CI4MS stored XSS in Pages module","severity":"medium","exploited":false,"published_at":"2026-04-08T15:16:14.057+00:00","url":"https://junglewise.ai/threats/cve-2026-39392-ci4-cms-erp-ci4ms-stored-xss-in-pages-module"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}