PT-2026-31318 · Ci4Ms+1 · Ci4Ms+1

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-39391

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.4.0

Description CI4MS is a CodeIgniter 4-based CMS skeleton. Prior to version 0.31.4.0, the blacklist note parameter in the ajax blackList post() function within the UserController is stored in the database without sanitization and rendered into an HTML data-note attribute without escaping. This allows an administrator with blacklist privileges to inject arbitrary JavaScript that executes in the browser of any other administrator viewing the user management page.

Recommendations Update to version 0.31.4.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39391

GHSA-7CM9-V848-CFH2

Affected Products

Ci4Ms

Codeigniter4

References · 9

• 🔥 https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-7cm9-v848-cfh2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39391 · Security Note
• https://osv.dev/vulnerability/GHSA-7cm9-v848-cfh2 · Vendor Advisory
• https://github.com/ci4-cms-erp/ci4ms · Note
• https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.4.0 · Note
• https://t.me/CVEtracker/50062 · Telegram Post
• https://twitter.com/CVEnew/status/2041975655085076912 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2041924306079269158 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041977692073885711 · Twitter Post