The vulnerability is a stored DOM‑based cross‑site scripting flaw in the Menu Management feature of CI4MS. User‑controlled post data that is added to navigation menus is saved server‑side without proper sanitization or output encoding. When the navigation is later rendered in both administrative dashboards and public pages, the payload is executed in the victim’s browser. This flaw can lead to complete compromise of the authenticated account, including privilege escalation to higher‑level roles, because the RBAC system is bypassed by the injected code. The CVSS score of 9.1 reflects the severity and the potential to affect both confidentiality and integrity.

The flaw affects the CI4CMS‑ERP CI4MS application. Any deployment running a version earlier than 0.31.0.0 is vulnerable. The vendor has released a patch in release 0.31.0.0 that correctly sanitizes the input and prevents the payload from being stored and executed.

The vulnerability carries a high severity score and exists in a widely distributed CMS skeleton. Although the EPSS score is currently below 1% and it is not listed in the CISA KEV catalog, the exploitation path is straightforward for an attacker who can submit a post in the menu management interface, or for a compromised valid user. Once injected, the malicious script runs in the context of any user who views the affected navigation, making the risk of account takeover and privilege escalation significant.