CVE-2025-41036
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
appRain CMF version 4.0.5 has a stored authenticated XSS vulnerability due to lack of proper validation of user input in the 'data[Admin][description]', 'data[Admin][f_name]', and 'data[Admin][l_name]' parameters in /apprain/admin/account/edit.
Risk Assessment
An authenticated attacker can inject a malicious script that executes in the browsers of administrators, potentially leading to account takeover, data theft, or unauthorized actions in the system.
Recommendation
Update appRain CMF to a patched version. Additionally, implement input validation and sanitization, and restrict access to the admin panel.
Other vulnerabilities in appRain CMF
See all- CVE-2024-58279High
appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by uploading a crafted PHP file to the site's uploads directory.
- CVE-2025-41052Medium
Stored XSS vulnerability in appRain CMF version 4.0.5 due to lack of input validation in 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/canvasjs. Requires authentication.
- CVE-2025-41044Medium
Stored XSS vulnerability in appRain CMF version 4.0.5 due to lack of input validation in the 'data[Page][name]' parameter in /apprain/page/manage-static-pages/create. Requires authentication.
Original NVD description (English source)
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Admin][description]', 'data[Admin][f_name]' and 'data[Admin][l_name]' parameters in /apprain/admin/account/edit.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS