GHSA-5ghq-42rg-769xCriticalCVSS 9.1

CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

Published
April 6, 2026
Last Modified
April 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-35035 →

📋 Description

An attacker can acheive Full Account Takeover & Privilege Escalation via Stored DOM Blind XSS on public-facing landing pages through the System Settings Company Information section which allows the injection of XSS payloads

🎯 Affected products1

  • composer/ci4-cms-erp/ci4ms:<= 0.31.1.0

🔗 References (4)