https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 20:41:25 +0000 https://cve.radiocsirt.org/vuln/cve-2026-45138 <p><strong>Affected:</strong> ci4-cms-erp ci4ms</p> <p>CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (`?string &amp;$str`), but CodeIgniter 4&#39;s validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes `$lanData[&#39;content&#39;]` directly into `blog_langs.content`, and the public template echoes it without escaping — yielding stored XSS executable in any visitor&#39;s browser, including the superadmin when previewing or editing posts. Version 0.31.9.0 patches the issue.</p> <p><strong>Affected:</strong> ci4-cms-erp ci4ms</p> <p>CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (`?string &amp;$str`), but CodeIgniter 4&#39;s validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes `$lanData[&#39;content&#39;]` directly into `blog_langs.content`, and the public template echoes it without escaping — yielding stored XSS executable in any visitor&#39;s browser, including the superadmin when previewing or editing posts. Version 0.31.9.0 patches the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-45138