CI4MS is a CodeIgniter 4‑based CMS skeleton that contains a stored cross‑site scripting flaw in the backend user management module. The application fails to sanitize user‑controlled input before rendering it in the administrative interface, enabling attackers to embed persistent JavaScript. When other backend users visit the affected page, the malicious script executes automatically, allowing the attacker to hijack sessions, elevate privileges, and ultimately compromise full administrative accounts.

The vulnerable product is CI4MS from the vendor ci4‑cms‑erp. Any installation of CI4MS releasing before version 0.31.0.0 is susceptible; the flaw exists in core backend functionality and is not tied to a specific feature or plugin.

The CVSS score of 10 marks it as critical, although the EPSS score of less than 1 % indicates a low current likelihood of exploitation, and the vulnerability has not been listed in CISA’s KEV catalog. The attack requires that an attacker inject malicious content into the backend user management interface, an action likely restricted to users with administrative privileges. Once injected, the script executes for any backend user who views the page, permitting cookie theft, session hijacking, and privilege escalation without additional authentication.