PT-2026-31317 · Ci4Ms · Ci4Ms

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-39390

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.4.0

Description CI4MS is a CodeIgniter 4-based CMS skeleton. Prior to version 0.31.4.0, the Google Maps iframe setting (cMap field) in the compInfosPost() function does not properly sanitize the srcdoc attribute, allowing an attacker with admin access to inject a malicious iframe payload with HTML-entity-encoded JavaScript. This injected code executes in the context of the parent page when viewed by unauthenticated users.

Recommendations Update to version 0.31.4.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39390

GHSA-X3HR-CP7X-44R2

Affected Products

Ci4Ms

References · 9

• 🔥 https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-x3hr-cp7x-44r2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39390 · Security Note
• https://osv.dev/vulnerability/GHSA-x3hr-cp7x-44r2 · Vendor Advisory
• https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.4.0 · Note
• https://github.com/ci4-cms-erp/ci4ms · Note
• https://twitter.com/infoflowcloud/status/2041977743252881501 · Twitter Post
• https://twitter.com/CVEnew/status/2041975656381030736 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2041929425260859647 · Twitter Post
• https://t.me/CVEtracker/50061 · Telegram Post