CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 31.0.0.0, the application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side. This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS). This vulnerability is fixed in 31.0.0.0.

Affected: Packagist: ci4-cms-erp/ci4ms

## Summary ### **Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)** - Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

### Description The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

### Affected Functionality - Profile name / full name update functionality (both the 2 user inputs) - User profile storage and retrieval logic

### Attack Scenario - An attacker updates their profile name to include a malicious XSS payload. - The application stores this value without sanitization or encoding. - The payload persists and executes whenever the name is rendered in affected views.

### Impact - Persistent Stored XSS - Execution of arbitrary JavaScript in victims’ browsers - Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: `/backend/users/profile/`

### **Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)** (Required for the chain) - Stored XSS via Unsafe Rendering of User Names Across Adm…