En resumen
- CVE-2026-41201 es una vulnerabilidad CRÍTICO (CVSS 9.1) que afecta a ci4-cms-erp/ci4ms.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.33%, mayor que el 26.3% de las vulnerabilidades.
- Solución: actualizar a 0.31.5.0 o posterior.
Description
An attacker can achieve Full Account Takeover and Privilege Escalation via Stored DOM XSS in the backup module's filename field, which is manipulated through an SQL file that tampers with the filename field to contain a hidden XSS payload.
NVD description
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. In version 0.31.4.0, an attacker can achieve Full Account Takeover & Privilege Escalation via Stored DOM XSS in backup module filename field manipulated via a sql file that tampers with the file name field to contain hidden XSS payload. This issue has been patched in version 0.31.5.0.
Más vulnerabilidades de ci4-cms-erp/ci4ms
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free