Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
36 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Vulnerability: Stored DOM XSS via Pages Added to Menu (Persistent Payload Injection) - Stored Cross-Site Scripting via Unsafe Rendering of Page Entries in Menu Management Description The application fails to properly sanitize user-controlled input when adding Pages to navigation menus through the Menu Management functionality. Page-related data selected via the Pages section is stored server-side and rendered without proper output encoding. This stored payload is later rendered unsafely within administrative interfaces and public-facing navigation menus, leading to stored DOM-based cross-site scripting (XSS). Affected Functionality - Menu Management – Pages section - Adding pages to navigation menus - Menu storage and rendering logic Attack Scenario - An attacker creates or controls a page containing a malicious JavaScript payload. - The attacker adds the page to the menu using the Pages functionality in Menu Manager. - The application stores the menu entry without…
Recommended action: Upgrade to 0.31.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability: Stored DOM Blind XSS via Backup Management Filename (Persistent Payload Injection) - Stored Cross-Site Scripting (Blind XSS) via Unsanitized Backup Filename in Backup Management Description The application fails to properly sanitize user-controlled input when handling backup uploads and processing backup metadata. An attacker can inject a malicious JavaScript payload into the backup filename via the uploaded xss.sql, which uses SQL functionality to insert the XSS payload server-side. This stored payload is later rendered unsafely in multiple backup management views without proper output encoding, leading to stored blind cross-site scripting (Blind XSS). Affected Functionality - Backup upload functionality - Backup processing functionality - Backup storage and retrieval logic Attack Scenario - An attacker uploads xss.sql which uses SQL functionality to insert a malicious XSS payload into the backup filename field server-side. - The application stores this…
Recommended action: Upgrade to 0.31.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability: Stored DOM XSS via System Settings – Company Information (Same-Page Attribute Breakout & Persistent Payload Injection) - Stored Cross-Site Scripting via Unsanitized Company Information Configuration Fields with Immediate Same-Page Execution Description The application fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative configuration fields accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. Affected fields include, but are not limited to: 1. Company Name 2. Slogan 3. Company Phone 4. Company Mobile 5. Company Email 6. Google Maps iframe link 7. Company Logo and other media-related fields Unlike the public-facing landing page injection vulnerability, this issue executes directly on the same settings page. The injected payload breaks out of the HTML attribute context and is immediately interpreted by the browser when rendered, resulting in…
Recommended action: Upgrade to 0.31.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability: Stored DOM XSS via System Settings – Social Media Management (Same-Page Attribute Breakout & Persistent Payload Injection) - Stored Cross-site Scripting via Unsanitized Social Media Configuration Fields with Immediate Same-Page Execution Description The application fails to properly sanitize user-controlled input within System Settings – Social Media Management. Multiple configuration fields, including Social Media and Social Media Link, accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. Unlike typical stored XSS that executes on other pages (such as public-facing landing pages), this vulnerability executes directly on the same settings page. The injected payload breaks out of the input attribute context and is immediately interpreted by the browser, resulting in same-page DOM-based XSS. This represents a different functionality and a separate vulnerability class from public-facing landing page…
Recommended action: Upgrade to 0.31.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability: Stored DOM Blind XSS via Logs Interface Rendering (Administrative Context Execution) - Stored Cross-Site Scripting (Blind XSS) via Unsafe Rendering of User-Controlled Logged Data Description The application renders user-controlled input unsafely within the logs interface. If any stored XSS payload exists within logged data, it is rendered without proper output encoding. This issue becomes a Blind XSS scenario because the attacker does not see immediate execution. Instead, the payload is stored within application logs and only executes later when an administrator views the logs page. For example, accessing /backend/backup/restore/xss-payload-here causes an error that gets logged by the application. If the injected portion contains an XSS payload, it is stored inside the logs without sanitization and later rendered unsafely inside the logs management interface. When an administrator views the logs page, the stored payload executes automatically in the…
Recommended action: Upgrade to 0.31.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability: Stored DOM XSS via Blog Tag Name (Persistent Payload Injection) - Stored Cross-Site Scripting via Unsanitized Blog Tag Name in Blog Management Description The application fails to properly sanitize user-controlled input when creating or editing blog tags. An attacker can inject a malicious JavaScript payload into the tag name field, which is then stored server-side. This stored payload is later rendered unsafely across public tag pages and administrative interfaces without proper output encoding, leading to stored cross-site scripting (XSS). Affected Functionality - Blog tag creation functionality - Blog tag editing functionality - Blog tag storage and retrieval logic Attack Scenario - An attacker creates or edits a blog tag name to include a malicious XSS payload. - The application stores this value without sanitization or encoding. - The payload persists and executes whenever the tag name is rendered in affected views. Impact - Persistent Stored XSS -…
Recommended action: Upgrade to 0.31.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability: Stored DOM XSS via Group / Role Management Fields (Administrative Context Execution) - Stored Cross-Site Scripting via Unsanitized Group / Role Management Inputs Description The application fails to properly sanitize user-controlled input within group and role management functionality. Multiple input fields (three distinct group-related fields) can be injected with malicious JavaScript payloads, which are then stored server-side. These stored payloads are later rendered unsafely within privileged administrative views without proper output encoding, leading to stored cross-site scripting (XSS) within the role and permission management context. Affected Functionality - Group creation and editing functionality - Role and permission assignment interfaces - Storage and retrieval of group-related data Attack Scenario - An attacker injects a malicious XSS payload into one or more group-related input fields. - The application stores these values without sanitization or…
Recommended action: Upgrade to 0.31.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability: Stored DOM XSS via Methods Management Fields (Global Persistent Payload Execution) - Stored Cross-Site Scripting via Unsanitized Method Creation and Management Inputs - Automatic Execution Across All Pages Where Method Is Rendered in Navigation Description The application fails to properly sanitize user-controlled input within the Methods Management functionality when creating or managing application methods/pages. Multiple input fields accept attacker-controlled JavaScript payloads that are stored server-side without sanitization or output encoding. These stored values are later rendered directly into administrative interfaces and global navigation components without proper encoding, resulting in Stored DOM-Based Cross-Site Scripting (XSS). Critically, because created methods are automatically rendered inside the system’s navigation/menu structure, the injected payload executes globally — meaning every page visited where the malicious method appears in the…
Recommended action: Upgrade to 0.31.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability: Stored DOM XSS via System Settings – Mail Settings (Same-Page Attribute Breakout & Persistent Payload Injection) - Stored Cross-Site Scripting via Unsanitized Mail Settings Configuration Fields Description The application fails to properly sanitize user-controlled input within System Settings – Mail Settings. Several configuration fields, including Mail Server, Mail Port, Email Address, Email Password, Mail Protocol, and TLS settings, accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. Unlike public-facing XSS that executes on landing pages, this vulnerability executes immediately on the same settings page. The injected payload breaks out of the HTML attribute context and is interpreted by the browser when rendered, resulting in same-page DOM-based XSS. This represents different functionality and a separate vulnerability from landing-page injection. Example Affected Fields - Mail Server: test - Mail…
Recommended action: Upgrade to 0.31.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A critical vulnerability has been identified in CI4MS that allows an authenticated user with file editor permissions to achieve Remote Code Execution (RCE). By leveraging the file creation and save endpoints, an attacker can upload and execute arbitrary PHP code on the server. Vulnerability Details The vulnerability exists in the /backend/fileeditor/createFile and /backend/fileeditor/save API endpoints. Unrestricted File Creation: The createFile endpoint allows users to create files with any extension (including .php) in web-accessible directories such as /public. Arbitrary Content Injection: The save endpoint allows users to write arbitrary content into the created files without sufficient server-side validation or sanitization. An attacker can combine these two flaws to create a PHP webshell and execute system-level commands, leading to a complete compromise of the web server. Impact Successful exploitation allows: Full access to the server's file system and databases.…
Recommended action: Upgrade to 0.28.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The authentication implementation in CI4MS is vulnerable to email enumeration. An unauthenticated attacker can determine whether an email address is registered in the system by analyzing the application's response during the password reset process. Vulnerability Details - The password reset flow returns different responses based on whether the provided email address exists in the database or not. - If the email is registered, the system typically returns a success message (e.g., "Password reset link has been sent"). If the email is not registered, the system returns an error message (e.g., "User not found" or a different HTTP status code). This discrepancy allows attackers to programmatically "enumerate" or confirm valid user emails, which can then be used for targeted phishing attacks or brute-force attempts. Steps to Reproduce 1. Navigate to the password reset page of the CI4MS installation. 2. Enter an email address that you know is not registered (e.g.,…
Recommended action: Upgrade to 0.28.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.