PT-2026-34596

CVE-2026-41201

Published

2026-04-22

Updated

2026-05-12

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.5.0

Description A Stored DOM XSS (Cross-Site Scripting) issue exists in the backup module. An attacker can manipulate the filename field using an SQL file to inject a hidden XSS payload, potentially leading to full account takeover and privilege escalation.

Recommendations Update to version 0.31.5.0. As a temporary workaround, restrict access to the backup module to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Bugmithlegend

Dexterhk

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')