CVE-2025-41050

appRain CMF 4.0.5 is affected by a stored authenticated XSS in the /apprain/developer/addons/update/base_libs endpoint, triggered via data[Addon][layouts] and data[Addon][layouts_except]. CNVD, RH, NVD, and CVE records agree on the affected version and parameters. The vulnerability could enable a...

CVE-2025-41047 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/ace...

PT-2025-35927

Name of the Vulnerable Software and Affected Versions: appRain CMF version 4.0.5 Description: A stored authenticated cross-site scripting XSS issue exists due to insufficient validation of user-supplied data. The vulnerability is triggered through the dataAddonlayouts and dataAddonlayouts except...