CI4MS CMS Vulnerable to Stored XSS via Menu Management

CVE Notify is flagging a critical stored DOM-based cross-site scripting (XSS) vulnerability impacting versions of CI4MS prior to 0.31.0.0. The issue stems from improper sanitization of user-controlled input within the Menu Management functionality. Specifically, when adding Pages to navigation menus, data related to these pages is stored on the server and later rendered without adequate output encoding. This can lead to malicious payloads being injected and executed within administrative interfaces and public-facing navigation elements.

This means an attacker could potentially inject scripts that execute in the context of other users, including administrators. CVE Notify highlights that this vulnerability is particularly concerning because the stored payload can surface in multiple locations, increasing the attack surface. The good news is that this has been addressed in version 0.31.0.0, so patching is the clear path forward.