EUVD-2026-20484
GHSA-7cm9-v848-cfh2
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the blacklist (ban) note parameter in UserController::ajax_blackList_post() is stored in the database without sanitization and rendered into an HTML data-note attribute without escaping. An admin with blacklist privileges can inject arbitrary JavaScript that executes in the browser of any other admin who views the user management page. This vulnerability is fixed in 0.31.4.0.
AnalysisAI
Stored cross-site scripting (XSS) in CI4MS prior to 0.31.4.0 allows authenticated administrators with blacklist privileges to inject arbitrary JavaScript through unsanitized note parameters, which executes in the browsers of other administrators viewing the user management page. The vulnerability requires high-privilege authenticated access and user interaction (admin viewing the affected page), limiting real-world impact despite the network-accessible attack vector.
Technical ContextAI
CI4MS is a CodeIgniter 4-based content management system that implements role-based access control (RBAC) for administrative functions. The vulnerability exists in UserController::ajax_blackList_post(), where user blacklist note data flows unsafely from client input directly into the database without sanitization, then is rendered into HTML data-note attributes without proper output escaping. This is a classic stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where the injection point is an HTML attribute context rather than element content, allowing attackers to break out of the attribute and inject event handlers or script tags. The affected product CI4MS (CPE: cpe:2.3:a:ci4-cms-erp:ci4ms) uses CodeIgniter 4 framework, which provides XSS protection utilities that were not applied in this endpoint.
RemediationAI
Vendor-released patch: upgrade to CI4MS 0.31.4.0 or later, which includes sanitization of the blacklist note parameter before database storage and proper HTML escaping during attribute rendering. No workarounds are available for earlier versions; immediate upgrade is the primary remediation path. Organizations unable to upgrade immediately should restrict the blacklist privilege to highly trusted administrators and monitor admin page access logs for suspicious activity. Refer to the official GitHub Security Advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-7cm9-v848-cfh2 for patch deployment details.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today