9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35035

CVE-2026-35035: CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

Summary

Vulnerability: Stored DOM XSS in main landing page via System Settings – Company Information (Persistent Payload Injection)

Stored Cross-Site Scripting via Unsanitized Company Information Configuration Fields

Description

The application fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative configuration fields accept attacker-controlled input that is stored server-side and later rendered without proper output encoding.

Affected fields include, but are not limited to:

Company Name
Slogan
Company Phone
Company Mobile
Company Email
Google Maps iframe link
Company Logo and other media-related fields

These values are persisted in the database and rendered unsafely on public-facing pages only, such as the main landing page. There is no execution in the administrative dashboard—the vulnerability only impacts the public frontend.

Unlike the same-page stored DOM XSS vulnerability, this issue executes only on separate public-facing pages and not on the settings page itself.

Affected Functionality

System Settings – Company Information configuration
Public-facing page rendering (main landing page and other public pages)
Storage and retrieval of company information values

Attack Scenario

An attacker injects a malicious JavaScript payload into one or more Company Information fields.
The application stores these values without sanitization or encoding.
The payload is rendered only on public-facing pages, including the main landing page.
The payload executes automatically in the browser context of who access the public site.

Miggo Vulnerability Database

→

CVE-2026-35035

CVE-2026-35035:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ci4-cms-erp/ci4ms	composer	<= 0.31.1.0	0.31.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue originating from the 'System Settings' page. The root cause is the insufficient sanitization of user-provided data before it is saved to the database. This stored malicious data is then rendered on public-facing pages, executing in the browsers of visitors.

The analysis of the patch commit revealed two key functions in modules/Settings/Controllers/Settings.php that were responsible for processing and storing the vulnerable data:

Modules\Settings\Controllers\Settings::compInfosPost: This function handles the 'Company Information' form. The patch shows that several fields, most notably the 'Google Maps iframe' (cMap), were not properly sanitized. The fix involves adding stricter validation rules and explicitly removing JavaScript event handlers from the iframe input. This function is a runtime indicator when an attacker is injecting the payload.
Modules\Settings\Controllers\Settings::socialMediaPost: This function handles the 'Social Media' links. The patch shows the addition of strip_tags to the social media name field (smName), indicating that it was previously possible to store HTML and script content in this field.

While the patch does not include the public-facing views where the XSS payload would execute, the identified functions are the entry point for the malicious data. Therefore, they are critical indicators of the vulnerability being present and are the functions that would appear in a runtime profile during the injection phase of an exploit.

Vulnerable functions

Modules\Settings\Controllers\Settings::compInfosPost

modules/Settings/Controllers/Settings.php

This function processes and stores company information from the settings page. The vulnerability lies in the insufficient sanitization of the 'Google Maps iframe link' field (`cMap`). Before the patch, it was possible to inject JavaScript event handlers (e.g., `onerror`) within the `<iframe>` tag. The patch mitigates this by using `preg_replace` to strip `on*` event attributes from the input before saving it to the database, thus preventing the stored XSS payload.

Modules\Settings\Controllers\Settings::socialMediaPost

modules/Settings/Controllers/Settings.php

This function handles the saving of social media links. The 'smName' (social media name) field was previously stored without proper sanitization, allowing an attacker to inject HTML and JavaScript. The patch adds `strip_tags` to remove any HTML from the 'smName' input before it is stored, preventing the stored XSS vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

9.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-35035: CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

Summary

Vulnerability: Stored DOM XSS in main landing page via System Settings – Company Information (Persistent Payload Injection)

Description

Affected Functionality

Attack Scenario

CVE-2026-35035:

9.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

9.1

9.1

Basic Information

Basic Information

Technical Details

CVE-2026-35035: CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

Summary

Vulnerability: Stored DOM XSS in main landing page via System Settings – Company Information (Persistent Payload Injection)

Description

Affected Functionality

Attack Scenario

Impact

Steps To Reproduce (POC)

Remediation

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI