CI4MS, a CodeIgniter 4-based CMS skeleton, contained a stored DOM XSS flaw that allowed user input to be rendered unsafely within the logs interface. The flaw created a blind XSS scenario: a payload could be stored in application logs but would only execute when an administrator viewed the logs page. Execution of arbitrary JavaScript in the administrator’s browser context could lead to full account takeover and privilege escalation. The weakness aligns with CWE‑79: Improper Neutralization of Input During Web Page Generation.

The vulnerability affects the CI4MS content management system distributed by ci4‑cms‑erp. Versions prior to 0.31.0.0 of the CI4MS package are susceptible when the logs feature is enabled. The flaw is present in all roles with access to the logs page and can be exploited by any user capable of submitting data that is captured in the logs.

The CVSS score of 9.1 indicates a high‑severity impact, and the EPSS score indicates a low probability of exploitation at present (<1 %). The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no known active exploitation. The likely attack path requires an attacker to inject malicious input that will be recorded in logs and later trigger execution when an administrator reviews those logs. This benign‑looking log entry method makes it a difficult scenario to detect, but when leveraged it can grant full administrative control over the affected system.