EUVD-2026-18072
GHSA-r4v5-rwr2-q7r4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Lifecycle Timeline
4DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application renders user-controlled input unsafely within the logs interface. If any stored XSS payload exists within logged data, it is rendered without proper output encoding. This issue becomes a Blind XSS scenario because the attacker does not see immediate execution. Instead, the payload is stored within application logs and only executes later when an administrator views the logs page. This issue has been patched in version 0.31.0.0.
AnalysisAI
Blind stored XSS in CI4MS CMS log viewer allows authenticated attackers to execute JavaScript in administrator sessions when reviewing application logs. Affects CI4MS versions prior to 0.31.0.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | CI4MS versions prior to 0.31.0.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Despite the Critical 9.1 CVSS score, real-world exploitability requires specific preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated attacker with low-level user privileges registers an account or submits a form containing malicious JavaScript payload disguised within legitimate input, such as a username field with embedded script tags or event handlers. The application logs this activity without sanitization, storing the payload in the log database. … |
| Remediation | Vendor-released patch: version 0.31.0.0 addresses the vulnerability by implementing proper output encoding in the logs interface rendering logic. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all CI4MS deployments and confirm installed versions against 0.31.0.0 baseline; restrict log viewer access to essential personnel only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today