Profile Management CVE-2026-34989
CRITICAL
GHSA-vr2g-rhm5-q4jr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker logs into application
-
DeliveryInjects malicious JavaScript in profile name field
-
ExploitPayload stored server-side without sanitization
-
ExecutionVictim views attacker's profile
-
PersistJavaScript executes in victim's browser
-
ImpactAttacker steals session cookies or credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated user account required. Attacker with valid login credentials injects malicious JavaScript payload into profile name field during profile update. Payload executes when any user views the attacker's profile or pages displaying the unsanitized profile name without proper output encoding. |
| Impact | This vulnerability presents elevated real-world risk despite the absence of CVSS scoring and EPSS data. The attack chain combines two critical factors: trivial exploitation complexity (simple form submission with basic XSS payload) and severe impact (administrative privilege escalation leading to full application compromise). The stored nature of the XSS ensures persistence across sessions, and the multi-context rendering guarantees that any administrator accessing standard user management functions will trigger the payload. Attack vector is network-based requiring only authenticated user access to the profile update function, making it accessible to any registered user. The availability of proof-of-concept code (video demonstration provided) and a public GitHub security advisory increases exploitation likelihood. While not listed in CISA KEV and lacking public exploit code in repositories, the detailed disclosure with working POC substantially lowers the barrier to exploitation. The privilege escalation pathway from standard user to full administrator represents a complete security boundary violation, warranting immediate prioritization regardless of traditional risk metrics. |
| Exploit ScenarioDerived | An attacker with standard user credentials logs into the ci4-cms-erp/ci4ms application and navigates to the profile management page. They update either full name field with the payload <img src=x onerror=alert(document.domain)> (or more sophisticated session-stealing code) and save the profile. The application stores this malicious payload without sanitization. When an administrator subsequently accesses the user management interface at /backend/users/ to perform routine administrative tasks, the stored payload executes automatically in the administrator's browser context. Instead of a simple alert, a realistic attack would use JavaScript to exfiltrate the administrator's session token to an attacker-controlled server, allowing complete session hijacking. The attacker then uses the stolen admin session to create new administrative accounts, modify application configurations, access sensitive data, or deploy persistent backdoors. The same payload also executes on public blog pages where the attacker's profile name appears, potentially compromising other users' sessions and expanding the attack surface across the entire application user base. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 03, 2026
Stored cross-site scripting (XSS) in ci4-cms-erp/ci4ms profile management enables privilege escalation to full administrative compromise. Attackers inject malicious JavaScript payloads through unsanitized profile name fields, which execute persistently across multiple application interfaces including administrative user management pages and public-facing blog views. When administrators access affected pages, the stored payload executes in their browser context, enabling session hijacking and complete account takeover. Vendor patch available per GitHub security advisory. This represents a critical privilege escalation vector requiring immediate remediation in any deployment with multiple user roles.
RemediationAI
Vendor-released patch available per GitHub security advisory GHSA-vr2g-rhm5-q4jr. Affected organizations should immediately update the ci4-cms-erp/ci4ms Composer package to the patched version specified in the advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vr2g-rhm5-q4jr. The fix implements comprehensive output encoding for user-controlled profile data and replaces unsafe DOM manipulation methods (.html(), innerHTML) with safe alternatives (.text(), textContent) across all rendering contexts. Additionally, the patch introduces server-side input sanitization on profile name fields before database storage. Until patching is complete, implement emergency mitigations: restrict access to profile update functionality to trusted users only, enable Content Security Policy headers with script-src directives to block inline script execution, and monitor administrative session activity for anomalous behavior. Review application logs for profile updates containing HTML special characters (angle brackets, script tags) as potential indicators of exploitation attempts. No effective workaround exists that maintains full functionality without code modification.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability chain exploits CWE-79 (Improper Neutralization of Input During Web Page Generation) in the ci4-cms-erp/ci4ms Composer package, a CodeIgniter 4-based content management system. The application uses unsafe DOM manipulation methods (specifically .html() and innerHTML) to render user-controlled profile data without output encoding. User input flows through two attack surfaces: the profile update endpoint (/backend/users/profile/) accepts unvalidated input for full name fields, and multiple rendering contexts (/backend/users/, public blog pages, and other user profile displays) output this data directly into the DOM. The lack of server-side input sanitization combined with client-side unsafe DOM sinks creates a stored XSS condition where payloads persist in the database and execute across session boundaries. The multi-context rendering amplifies impact, as a single payload injection affects both administrative and public-facing surfaces.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (https://github.com/ci4-cms-erp/ci4ms) · only source for this CVE.
CVSS VectorVendor: https://github.com/ci4-cms-erp/ci4ms
Lifecycle Timeline
2DescriptionCVE.org
Summary
Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)
- Stored Cross-Site Scripting via Unsanitized User Name in Profile Management
Description
The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.
This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).
Affected Functionality
- Profile name / full name update functionality (both the 2 user inputs)
- User profile storage and retrieval logic
Attack Scenario
- An attacker updates their profile name to include a malicious XSS payload.
- The application stores this value without sanitization or encoding.
- The payload persists and executes whenever the name is rendered in affected views.
Impact
- Persistent Stored XSS
- Execution of arbitrary JavaScript in victims’ browsers
- Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names
Endpoint: /backend/users/profile/
Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)
(Required for the chain)
- Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces
Description
User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.
When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.
This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:
- User management interfaces
- Blog pages
- Other content or UI components displaying usernames
Attack Scenario
- Attacker injects a malicious payload via the profile name update functionality.
- The payload is stored persistently.
- An administrator views the user management page or any affected interface.
- The payload executes automatically in the admin’s browser.
- Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.
Impact
- Stored XSS
- Administrative privilege escalation
- Full admin account takeover (including other roles)
- Full compromise of the entire application
Endpoint Example: /backend/users/ of User Management Page
Steps To Reproduce (POC)
- Go to Profile Management page of the User
- In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as:
<img src=x onerror=alert(document.domain)>
- Save the edit
- Go to User Management page as an Admin or any other role
- Notice the XSS alert popping up that confirms it
- Other endpoints aswell can execute such as blogs in the public facing one
Recommended Remediation
- Eliminate Unsafe DOM Sinks: Remove all usage of
.html(),innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as.text()ortextContent, which do not interpret HTML markup. - Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g.,
<,>,",') are rendered as literal text rather than interpreted as executable markup. - Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields - particularly the profile name fields - at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.
- Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.
Ready Video POC:
https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M
Executive ViewAI
CI4 CMS-ERP contains a critical stored cross-site scripting vulnerability in profile management that enables attackers to escalate privileges to full administrative control when administrators access compromised pages. This affects any deployment with multiple user roles and requires immediate patching to prevent complete system compromise.
Apply vendor patch. If immediate patching is not feasible: implement Web Application Firewall (WAF) rules to block script tags and JavaScript event handlers in profile submission requests; restrict administrative user access to essential personnel only; enable and monitor all administrative action logs for unauthorized account changes; implement network segmentation to limit administrator access to administrative interfaces.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB