Vulnerabilities in ci4-cms-erp

36 results
Vexday analysis

O CI4-CMS-ERP apresenta 36 vulnerabilidades conhecidas, sendo 17 críticas, com predominância de falhas de injeção XSS (CWE-79) que afetam a integridade da aplicação. Embora nenhuma esteja sob exploração ativa no momento, o ritmo recente de 9 divulgações nos últimos 90 dias indica que o produto continua gerando descobertas de segurança, exigindo monitoramento próximo e priorização de patches nas versões em produção.

CVE-2026-34564CRITICALCI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-34558CRITICALCI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-34989CRITICALCI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-34562MEDIUMCI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-34567CRITICALCI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-34563CRITICALCI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSSEPSS 0.3%CVE-2026-34566CRITICALCI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-41891MEDIUMCI4MS: Deactivated User Session Bypass (active=0)EPSS 0.3%CVE-2026-34565CRITICALCI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-45139MEDIUMCI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operationsEPSS 0.3%CVE-2026-39392MEDIUMCI4MS has Stored XSS in Pages Content Due to Missing html_purify SanitizationEPSS 0.2%CVE-2026-39390MEDIUMCI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe settingEPSS 0.2%CVE-2026-39391MEDIUMCI4MS has Stored XSS via Unescaped Blacklist Note in Admin User ListEPSS 0.2%CVE-2026-34561MEDIUMCI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.2%CVE-2026-45270HIGHCI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation RuleEPSS 0.2%CVE-2026-45138MEDIUMCI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation RuleEPSS 0.1%