ci4-cms-erp vulnerabilities
36 published CVEs name ci4-cms-erp among the affected products.
- 36Published CVEs36 of them scored
- 36Last 12 monthspublished in the last year
- 17Critical7 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-45270
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
ci4-cms-erp · ci4ms
High8.7 - CVE-2026-45139
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
ci4-cms-erp · ci4ms
Medium6.5 - CVE-2026-45138
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
ci4-cms-erp · ci4ms
Medium5.4 - CVE-2026-41891
CI4MS: Deactivated User Session Bypass (active=0)
ci4-cms-erp · ci4ms
Medium5.3 - CVE-2026-41890
CI4MS: Arbitrary Database Table Drop via Theme deleteProcess
ci4-cms-erp · ci4ms
Medium6.9 - CVE-2026-41203
ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE
ci4-cms-erp · ci4ms
Critical9.4 - CVE-2026-41202
ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE
ci4-cms-erp · ci4ms
Critical9.4 - CVE-2026-41201
CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2
ci4-cms-erp · ci4ms
Critical9.1 - CVE-2026-41587
CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution
ci4-cms-erp · ci4ms
High8.6 - CVE-2026-39394
CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
ci4-cms-erp · ci4ms
High8.1