https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-22T05:55:51.937042+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-278730 EUVD-2026-278730 2026-10-22T05:55:51.939394+00:00 EUVD-2026-278730 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34564 fkie_cve-2026-34564 2026-10-22T05:55:51.939432+00:00

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when adding Pages to navigation menus through the Menu Management functionality. Page-related data selected via the Pages section is stored server-side and rendered without proper output encoding. This stored payload is later rendered unsafely within administrative interfaces and public-facing navigation menus, leading to stored DOM-based cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.

 https://cve.radiocsirt.org/vuln/ghsa-g4pp-fhgf-8653 GHSA-g4pp-fhgf-8653 — CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS 2026-10-22T05:55:51.939467+00:00

Affected: Packagist: ci4-cms-erp/ci4ms

## Summary ### **Vulnerability: Stored DOM XSS via Pages Added to Menu (Persistent Payload Injection)** - Stored Cross-Site Scripting via Unsafe Rendering of Page Entries in Menu Management

### Description The application fails to properly sanitize user-controlled input when **adding Pages to navigation menus** through the Menu Management functionality. Page-related data selected via the Pages section is stored server-side and rendered without proper output encoding.

This stored payload is later rendered unsafely within administrative interfaces and public-facing navigation menus, leading to stored DOM-based cross-site scripting (XSS).

### Affected Functionality - Menu Management – Pages section - Adding pages to navigation menus - Menu storage and rendering logic

### Attack Scenario - An attacker creates or controls a page containing a malicious JavaScript payload. - The attacker adds the page to the menu using the **Pages** functionality in Menu Manager. - The application stores the menu entry without sanitization or encoding. - The payload persists and executes whenever the menu is rendered in administrative or public-facing interfaces.

### Impact - Persistent Stored DOM XSS - Execution of arbitrary JavaScript in victims’ browsers - Privilege escalation when viewed by administrators or privileged users - Full administrator account takeover - Full account takeover across all roles via the navigation menu - Full compromise of the entire application due to global exec…