The vulnerability is a stored cross‑site scripting flaw in the System Settings – Company Information section of the CI4MS CMS. Prior to version 0.31.2.0, the application fails to properly sanitize user‑controlled input from several administrative configuration fields. These values are persisted to the database and later rendered on public‑facing pages, such as the main landing page, without output encoding, allowing an attacker to inject arbitrary client‑side code that executes in the browsers of anyone who visits that page. The flaw does not affect the administrative dashboard and is limited to the public frontend.

All installations of the CI4MS product (ci4‑cms‑erp:ci4ms) whose application version is older than 0.31.2.0 are affected. The issue is present in each release preceding that version and applies to any site that still allows administrators to edit the Company Information fields.

The CVSS score of 7.2 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to modify the Company Information fields, which is likely only possible with administrative access – this inference is based on the fact that the fields are administrative configuration items. Once the attacker injects malicious code, any visitor to the affected public page will execute that code in their browser.