Vendor

    Ci4-cms-erp

    36 known vulnerabilities in products by Ci4-cms-erp, 0 of them actively exploited (CISA KEV).

    Key figures

    36

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    20

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Ci4-cms-erp
    CriticalCVE-2026-25510

    CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor

    		10.0
    CriticalCVE-2026-41202

    ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE

    		—
    CriticalCVE-2026-41203

    ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE

    		—
    HighCVE-2026-41587

    Ci4-cms-erp Ci4MS: Unrestricted Upload of File with Dangerous Type

    		—
    HighCVE-2026-34572

    Ci4-cms-erp Ci4MS: Insufficient Session Expiration

    		8.8
    HighCVE-2026-34570

    Ci4-cms-erp Ci4MS: Insufficient Session Expiration

    		8.8
    CriticalCVE-2026-35035

    Ci4-cms-erp Ci4MS: Cross-site Scripting

    		9.0
    CriticalCVE-2026-39394

    CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller

    		8.1
    CriticalCVE-2026-34571

    Ci4-cms-erp Ci4MS: Cross-site Scripting

    		9.0
    CriticalCVE-2026-34560

    CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    		9.0
    CriticalCVE-2026-41201

    Ci4-cms-erp Ci4MS: Cross-site Scripting

    		9.1
    HighCVE-2026-45270

    CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

    		8.7
    HighCVE-2026-39393

    Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms

    		8.1
    CriticalCVE-2026-34989

    Ci4-cms-erp Ci4MS: Cross-site Scripting

    		9.0
    CriticalCVE-2026-34558

    Ci4-cms-erp Ci4MS: Cross-site Scripting

    		9.1
    CriticalCVE-2026-34557

    Ci4-cms-erp Ci4MS: Cross-site Scripting

    		9.1
    CriticalCVE-2026-34559

    CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    		9.0
    CriticalCVE-2026-34569

    Ci4-cms-erp Ci4MS: Cross-site Scripting

    		9.0
    CriticalCVE-2026-34568

    CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

    		9.0
    CriticalCVE-2026-34564

    Ci4-cms-erp Ci4MS: Cross-site Scripting

    		9.0
    CriticalCVE-2026-34562

    Ci4-cms-erp Ci4MS: Cross-site Scripting

    		9.0
    CriticalCVE-2026-34567

    Ci4-cms-erp Ci4MS: Cross-site Scripting

    		9.0
    CriticalCVE-2026-34566

    Ci4-cms-erp Ci4MS: Cross-site Scripting

    		9.0
    CriticalCVE-2026-34565

    Ci4-cms-erp Ci4MS: Cross-site Scripting

    		9.0
    CriticalCVE-2026-34563

    Ci4-cms-erp Ci4MS: Cross-site Scripting

    		9.0

    All vulnerabilities in search

    Products

    Products by Ci4-cms-erp
    Ci4-cms-erp Ci4MS360