CI4MS is a CodeIgniter 4‑based CMS skeleton that stores configuration values for mail settings without proper sanitization. When an attacker can inject malicious JavaScript into fields such as Mail Server or Email Password, those values are stored server‑side and later rendered in the admin interface. When an administrator or another privileged user views the configuration page, the injected script executes in the victim’s browser, creating a stored DOM XSS flaw that can hijack sessions, manipulate the UI, and grant the attacker full platform access or a higher privilege level.

The flaw affects all installations of the ci4-cms-erp CI4MS product running a version prior to 0.31.0.0. Any system that allows users with write permission to access the System Settings – Mail Settings page is at risk, regardless of deployment environment or hosting platform.

The CVSS score of 4.7 indicates moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. EPSS data is not available. Based on the description, it is inferred that the attack vector requires an authenticated request from a user who can edit mail settings. Successful exploitation results in client‑side JavaScript execution that can lead to session hijacking, privilege escalation, and full platform compromise.