GHSA-654x-9q7r-g966
Medium · 5.3CVSS
5.3
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
CI4MS Vulnerable to User Email Enumeration via Password Reset Flow
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | ci4-cms-erp/ci4ms | 0 | 0.28.5.0 |
Related vulnerabilities
- CVE-2026-25509 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular… Same vulnerability
- CVE-2026-25510 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular… Also affects ci4-cms-erp/ci4ms
- GHSA-gp56-f67f-m4px CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in… Also affects ci4-cms-erp/ci4ms
- CVE-2026-88834 A flaw was found in BusyBox's httpd web server. CWE-203
- CVE-2026-87620 Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-203
- CVE-2026-87623 Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-203
- CVE-2026-87619 Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a… CWE-203
- CVE-2026-87566 Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-203