CVE-2026-35035: CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS
An attacker can acheive Full Account Takeover & Privilege Escalation via Stored DOM Blind XSS on public-facing landing pages through the System Settings Company Information section which allows the injection of XSS payloads
Published Apr 6, 2026 · Updated Apr 30, 2026
Affected packages
ci4-cms-erp/ci4ms
- Ecosystem
- Composer (PHP)
- Affected
- <= 0.31.1.0
- Fixed in
- 0.31.2.0
- Check
composer show ci4-cms-erp/ci4ms
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An attacker can acheive Full Account Takeover & Privilege Escalation via Stored DOM Blind XSS on public-facing landing pages through the System Settings Company Information section which allows the injection of XSS payloads
Credited to bugmithlegend, peeefour.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Composer (PHP) vulnerabilities
All Composer (PHP) entriesCVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
critical9.4Apr 22, 2026CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
critical9.4Apr 22, 2026CVE-2026-34989
CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
critical9.0Apr 3, 2026CVE-2026-34557
CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
critical9.1Apr 1, 2026CVE-2026-34558
CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
critical9.1Apr 1, 2026CVE-2026-34559
CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
critical9.1Apr 1, 2026