CI4MS contains a stored DOM XSS flaw in the System Settings – Company Information section. Attacker‑controlled input is persisted in the database and later rendered without proper encoding, allowing malicious JavaScript to execute in the context of any user who views the settings page. Because the framework supports role‑based access control, an attacker can hijack sessions for administrators or any role, effectively achieving full account takeover and privilege escalation.

The affected product is CI4MS by ci4‑cms‑erp. Versions prior to 0.31.0.0 are vulnerable; the issue was fixed in the 0.31.0.0 release. All user roles that can modify system settings — including administrators, editors, and other privileged users — are at risk.

The CVSS score of 4.7 indicates moderate severity, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is through the web interface where an attacker with permissions to alter system settings injects malicious payloads, which are later executed when any user accesses the settings page.