https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 22:45:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-281089 EUVD-2026-281089 https://cve.radiocsirt.org/vuln/euvd-2026-281089 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34989 <p>CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 31.0.0.0, the application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side. This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS). This vulnerability is fixed in 31.0.0.0.</p> <p>CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 31.0.0.0, the application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side. This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS). This vulnerability is fixed in 31.0.0.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34989 https://cve.radiocsirt.org/vuln/ghsa-vr2g-rhm5-q4jr <p><strong>Affected:</strong> Packagist: ci4-cms-erp/ci4ms</p> <p>## Summary ### **Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)** - Stored Cross-Site Scripting via Unsanitized User Name in Profile Management</p> <p>### Description The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.</p> <p>This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).</p> <p>### Affected Functionality - Profile name / full name update functionality (both the 2 user inputs) - User profile storage and retrieval logic</p> <p>### Attack Scenario - An attacker updates their profile name to include a malicious XSS payload. - The application stores this value without sanitization or encoding. - The payload persists and executes whenever the name is rendered in affected views.</p> <p>### Impact - Persistent Stored XSS - Execution of arbitrary JavaScript in victims’ browsers - Foundation for privilege escalation and account takeover when viewed by privileged users &amp; normal ones across blogs and public facing pages that show user profiles full names</p> <p>Endpoint: `/backend/users/profile/`</p> <p>### **Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)** (Required for the chain) - Stored XSS via Unsafe Rendering of User Names Across Adm…</p> <p><strong>Affected:</strong> Packagist: ci4-cms-erp/ci4ms</p> <p>## Summary ### **Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)** - Stored Cross-Site Scripting via Unsanitized User Name in Profile Management</p> <p>### Description The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.</p> <p>This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).</p> <p>### Affected Functionality - Profile name / full name update functionality (both the 2 user inputs) - User profile storage and retrieval logic</p> <p>### Attack Scenario - An attacker updates their profile name to include a malicious XSS payload. - The application stores this value without sanitization or encoding. - The payload persists and executes whenever the name is rendered in affected views.</p> <p>### Impact - Persistent Stored XSS - Execution of arbitrary JavaScript in victims’ browsers - Foundation for privilege escalation and account takeover when viewed by privileged users &amp; normal ones across blogs and public facing pages that show user profiles full names</p> <p>Endpoint: `/backend/users/profile/`</p> <p>### **Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)** (Required for the chain) - Stored XSS via Unsafe Rendering of User Names Across Adm…</p> https://cve.radiocsirt.org/vuln/ghsa-vr2g-rhm5-q4jr