PT-2026-29627 · Ci4Ms · Ci4Ms

Bugmithlegend

+1

·

Published

2026-04-01

·

Updated

2026-04-02

·

CVE-2026-34562

CVSS v3.1

9.0

Critical

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.0.0
Description CI4MS fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative configuration fields, including Company Name, Slogan, Company Phone, Company Mobile, Company Email, Google Maps iframe link, and Company Logo, accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. This results in stored DOM-based Cross-Site Scripting (XSS) with immediate same-page execution. The vulnerability allows an attacker to inject a malicious JavaScript payload into these fields, which breaks out of the HTML attribute context and executes in the browser of the authenticated user managing settings. This can lead to administrative privilege escalation and full platform compromise. The affected API endpoint is /backend/settings/ (Company Information). The vulnerable parameters are the input fields within the Company Information section.
Recommendations Versions prior to 0.31.0.0: Upgrade to version 0.31.0.0 or later to address the vulnerability. Avoid unsafe DOM manipulation methods such as .html() and innerHTML. Apply HTML entity encoding to all user-controlled data before rendering it in the browser. Implement input sanitization to ensure all user-supplied input is properly sanitized before processing or output.

Fix

XSS

Weakness Enumeration

Related Identifiers

CVE-2026-34562
GHSA-V897-C6VQ-6CR3

Affected Products

Ci4Ms