CVE-2026-45138

Description

CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule

Overview

State

—

Assigner (CNA)

—

CVSS severity

medium

CVSS score

5.4 / 10

CVSS vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Effective score

5.4 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-45138

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-45875

Assigner

GitHub_M

Published

Jul 19, 2026, 11:18:51 PM

Updated

Jul 20, 2026, 1:18:54 PM

EUVD base score (CVSS 3.1)

5.4 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EUVD-reported EPSS

0.1500

Vendors

ci4-cms-erp

Products

ci4ms (< 0.31.9.0)

Aliases

GHSA-2m69-jmvh-6chr

ENISA description: CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (`?string &$str`), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes `$lanData['content']` directly into `blog_langs.content`, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts. Version 0.31.9.0 patches the issue.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-45138 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-45138 tenable:www.cve.org

• April 2026 Critical Patch Update Released | security - Oracle Blogs
  web:blogs.oracle.com

  For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.

  2026-05-26 03:07 UTC
• CISA Warns of Exploited Microsoft Defender 0-Day Flaws
  web:cyberpress.org

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

  2026-05-26 03:07 UTC
• Microsoft addresses 137 vulnerabilities in May's Patch Tuesday ...
  web:cyberscoop.com

  Threats Microsoft addresses 137 vulnerabilities in May's Patch Tuesday, including 13 rated critical The high volume of vulnerabilities reflects a growing trend researchers have been anticipating as artificial intelligence models are deployed to find previously uncovered defects in code.

  2026-05-26 03:07 UTC
• CVE-2026-45138 | Security Details | Sonatype Guide
  web:guide.sonatype.com

  Technical security analysis for CVE-2026-45138 . CVSS 5.1 severity. View CVSS vectors, CWE classifications, and exploit maturity ratings.

  2026-05-26 03:07 UTC
• KB5091158 - Description of the security update for SQL Server 2022 GDR ...
  web:support.microsoft.com

  Summary Improvements and fixes included in this update How to obtain and install the update More information File information Information about protection and security Summary This security update contains fixes and resolves vulnerabilities. To learn more about the vulnerabilities, see the following security advisories: CVE - 2026 -40370 - SQL Server Remote Code Execution Vulnerability The ...

  2026-05-26 03:07 UTC
• Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws
  web:thehackernews.com

  Microsoft patched 138 flaws, including 30 Critical bugs, as AI discovery expands Patch Tuesday risk.

  2026-05-26 03:07 UTC
• April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike
  web:www.crowdstrike.com

  Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

  2026-05-26 03:07 UTC
• Oracle Critical Patch Update Advisory - April 2026
  web:www.oracle.com

  This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

  2026-05-26 03:07 UTC
• Microsoft fixes 167 security flaws in April, second biggest Patch ...
  web:www.pcworld.com

  This month's Patch Tuesday includes an actively exploited Office zero-day vulnerability and several critical RCE bugs in Windows and Remote Desktop.

  2026-05-26 03:07 UTC
• Patch Tuesday May 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-05-26 03:07 UTC

Only Available for Registered Users. Sign in to view.