ci4-cms-erp ci4ms
Published Atomicorp research notes for CVEs affecting ci4-cms-erp ci4ms where WAF protections were observed during testing or engineering review.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
| CVE | Vulnerability | CVSS | Severity | Rules Observed |
|---|---|---|---|---|
| CVE-2026-39394 | CI4MS has an .env CRLF Injection via Unvalidated host Parameter in Install Controller | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 |
| CVE-2026-41203 | ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE | 9.4 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-41201 | CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2 | 9.1 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34563 | CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS | 9.0 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-45270 | CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-41587 | CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390501 , 393655 |
| CVE-2026-45138 | CI4MS: Stored XSS in Blog Content via Broken html_purify Validation Rule | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-39390 | CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting | 4.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-39392 | CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization | 4.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |