CVE-2026-35035 — CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready,…
Image via opengraph.githubassets.com
🚨 CVE-2026-35035 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.2.0 , the application fails to properly sanitize user-controlled input within System Settings – Company Information.
What This Means For You
- New vulnerability disclosed — verify if your stack is exposed.
Related ATT&CK Techniques
🛡️ Detection Rules
1 rule · 6 SIEM formats1 detection rule mapped to MITRE ATT&CK. Free Sigma YAML below.
Web Application Exploitation Attempt — CVE-2026-35035
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-35035 | XSS | Software: CI4MS, Affected Version: < 0.31.2.0, Vulnerable Component: System Settings – Company Information, Impact: Stored XSS on public-facing pages |
| CVE-2026-35035 | Information Disclosure | Software: CI4MS, Affected Version: < 0.31.2.0, Vulnerable Component: System Settings – Company Information, Impact: Unencoded user-controlled input rendered on public pages |
Source & Attribution
| Source Platform | Telegram |
| Channel | CVE Notify |
| Published | April 07, 2026 at 20:26 UTC |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related coverage
Daily Security Digest — 2026-05-22
13 vulnerability disclosures (5 Critical, 8 High) and 14 curated intelligence stories from 6 sources.
WordPress Ditty Plugin: Authorization Bypass Exposes Non-Public Content
CVE-2026-9011 — The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and...
CVE-2026-8692 — The Vedrixa Forms – User Registration Form, Signup Form &
CVE-2026-8692 — The Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder plugin for WordPress is vulnerable to authorization bypass...