Hoch
CVE-2026-45270
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 36
Filter zurücksetzen
Mittel
CVE-2026-45139
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
Mittel
CVE-2026-45138
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
Mittel
CVE-2026-41891
CI4MS has a Deactivated User Session Bypass (active=0)
Mittel
CVE-2026-41890
CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess
Hoch
CVE-2026-41587
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
Kritisch
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Kritisch
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Mittel
CVE-2026-41201
CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS
Hoch
CVE-2026-39394
CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
Hoch
CVE-2026-39393
CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass
Mittel
CVE-2026-39392
CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization
Mittel
CVE-2026-39391
CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List
Mittel
CVE-2026-39390
CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting
Mittel
CVE-2026-39389
CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files
Kritisch
CVE-2026-35035
CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS
Kritisch
CVE-2026-34989
CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Hoch
CVE-2026-34572
CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
Kritisch
CVE-2026-34571
CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise
Hoch
CVE-2026-34570
CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
Kritisch
CVE-2026-34569
CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Kritisch
CVE-2026-34568
CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Kritisch
CVE-2026-34567
CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Kritisch
CVE-2026-34566
CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.