Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

appRain CMF 4.0.5 Allows Attackers to Inject Malicious Code

CVE-2025-41058 · published 1 year ago
Summary

A security flaw in appRain CMF version 4.0.5 allows attackers to inject malicious code into the system, potentially allowing them to take control of the website or steal user data. This is a serious issue because it can be exploited by anyone who has permission to update add-ons on the website. To stay secure, update to the latest version of appRain CMF as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apprain apprain 4.0.5
cpe:2.3:a:apprain:apprain:4.0.5:*:*:*:*:*:*:*
Original advisory text
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and '...
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/row_manager.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published4 Sep 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-41058 · NVD
Track software like this
Free during beta