CVE-2026-35035 Details

A stored cross-site scripting vulnerability has been identified in CI4MS, a CodeIgniter 4-based CMS skeleton, in versions prior to 0.31.2.0. The issue arises from the application's failure to properly sanitize user input in the 'System Settings – Company Information' section. Several administrative fields, including Company Name, Slogan, Contact Numbers, Email, Google Maps iframe link, and media-related fields, allow the injection of malicious JavaScript payloads. These payloads are stored in the database and rendered unsafely on public-facing pages, such as the main landing page, executing automatically in the browsers of unauthenticated visitors and authenticated users.

Users are advised to update to version 0.31.2.0 or later. Additionally, avoid using methods that allow innerHTML-style JavaScript in PHP applications without proper sanitization. Implement Content Security Policy (CSP) and set cookies as HttpOnly, SameSite, and Secure to reduce the severity of cross-site scripting and escalated cross-site request forgery via XSS.