ci4-cms-erp ci4ms

Published Atomicorp research notes for CVEs affecting ci4-cms-erp ci4ms where WAF protections were observed during testing or engineering review.

These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.

Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.

CVEVulnerabilityCVSSSeverityRules Observed
CVE-2026-39394CI4MS has an .env CRLF Injection via Unvalidated host Parameter in Install Controller9.8 (v3.1)Critical340007 , 344360 , 347009
CVE-2026-45270CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule8.7 (v3.1)High333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755
CVE-2026-45138CI4MS: Stored XSS in Blog Content via Broken html_purify Validation Rule5.4 (v3.1)Medium333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755
CVE-2026-39390CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting4.8 (v3.1)Medium333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-39392CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization4.8 (v3.1)Medium333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755