ci4-cms-erp/ci4ms (Packagist)
Advisories
36
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 31.0.0.0 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require ci4-cms-erp/ci4ms:^31.0.0.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-gqr2-7hcg-rchf CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule |
High EPSS 0.26% |
< 0.31.9.0 | 0.31.9.0 |
| GHSA-245j-xjvr-xvm5 CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations |
Medium EPSS 0.32% |
< 0.31.9.0 | 0.31.9.0 |
| GHSA-2m69-jmvh-6chr CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule |
Medium EPSS 0.18% |
< 0.31.9.0 | 0.31.9.0 |
| GHSA-5hfv-c864-qcq9 CI4MS has a Deactivated User Session Bypass (active=0) |
Medium EPSS 0.27% |
>= 0.26.0, < 0.31.8.0 | 0.31.8.0 |
| GHSA-vgrf-pr28-vf98 CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess |
Medium EPSS 0.41% |
>= 0.31.1.0, < 0.31.8.0 | 0.31.8.0 |
| GHSA-fw49-9xq4-gmx6 CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution |
High EPSS 0.62% |
>= 0.26.0.0, < 0.31.7.0 | 0.31.7.0 |
| GHSA-xv3r-vr59-95rg CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE |
Critical EPSS 0.62% |
< 0.31.5.0 | 0.31.5.0 |
| GHSA-xp9f-pvvc-57p4 CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE |
Critical EPSS 0.68% |
< 0.31.5.0 | 0.31.5.0 |
| GHSA-qxpq-82f3-xj47 CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS |
Critical EPSS 0.33% |
< 0.31.5.0 | 0.31.5.0 |
| GHSA-vfhx-5459-qhqh CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller |
Critical EPSS 0.52% |
< 0.31.4.0 | 0.31.4.0 |
| GHSA-8rh5-4mvx-xj7j CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass |
High EPSS 0.42% |
< 0.31.4.0 | 0.31.4.0 |
| GHSA-fjpj-6qcq-6pw2 CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization |
Medium EPSS 0.25% |
< 0.31.4.0 | 0.31.4.0 |
| GHSA-7cm9-v848-cfh2 CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List |
Medium EPSS 0.23% |
< 0.31.4.0 | 0.31.4.0 |
| GHSA-x3hr-cp7x-44r2 CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting |
Medium EPSS 0.24% |
< 0.31.4.0 | 0.31.4.0 |
| GHSA-9rxp-f27p-wv3h CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files |
High EPSS 0.47% |
< 0.31.4.0 | 0.31.4.0 |
| GHSA-5ghq-42rg-769x CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS |
Critical EPSS 0.46% |
< 0.31.2.0 | 0.31.2.0 |
| GHSA-vr2g-rhm5-q4jr CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
Critical EPSS 0.30% |
< 31.0.0.0 | 31.0.0.0 |
| GHSA-8fq3-c5w3-pj3q CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) |
High EPSS 0.51% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-fc4p-p49v-r948 CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise |
Critical EPSS 0.40% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-4vxv-4xq4-p84h CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) |
High EPSS 0.51% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-fhrf-q333-82fm CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
Critical EPSS 0.33% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-x7wh-g25g-53vg CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
Critical EPSS 0.32% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-r33w-c82v-x5v7 CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
Critical EPSS 0.27% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-458r-h248-29c5 CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
Critical EPSS 0.27% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-xgh5-w62m-8mpr CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
Critical EPSS 0.27% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-g4pp-fhgf-8653 CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
Critical EPSS 0.31% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-85m8-g393-jcxf CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS |
Critical EPSS 0.27% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-v897-c6vq-6cr3 CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
Critical EPSS 0.28% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-gcfj-cf7j-vwgj CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
High EPSS 0.23% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-r4v5-rwr2-q7r4 CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
Critical EPSS 0.39% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-4333-387x-w245 CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
Critical EPSS 0.33% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-v77r-xg3p-75g7 CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
Critical EPSS 0.32% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-rpjr-985c-qhvm CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
Critical EPSS 0.32% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-66m2-v9v9-95c3 ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS |
High EPSS 0.37% |
< 0.31.0.0 | 0.31.0.0 |
| GHSA-gp56-f67f-m4px CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor |
High EPSS 0.89% |
< 0.28.5.0 | 0.28.5.0 |
| GHSA-654x-9q7r-g966 CI4MS Vulnerable to User Email Enumeration via Password Reset Flow |
Medium EPSS 0.39% |
< 0.28.5.0 | 0.28.5.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor