CVE-2025-41047

CVE-2025-41047 affects appRain CMF 4.0.5 and is a stored authenticated XSS caused by insufficient validation of input in the /apprain/developer/addons/update/ace endpoint, specifically data[Addon][layouts] and data[Addon][layouts_except]. Multiple connected records corroborate the vulnerability a...

CVE-2025-41046 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/960grid...

CVE-2025-41046 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/960grid...

CVE-2025-41046

CVE-2025-41046 : Multiple sources confirm a stored authenticated XSS in appRain CMF 4.0.5 via improper validation on input data[Addon][layouts] and data[Addon][layouts_except] at /apprain/developer/addons/update/960grid. Impact described across CNVD/NVD/RH/SNYK variants includes potential cookie-...

CVE-2025-41045 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datasconfigethicallicensekey' parameter in /apprain/admin/config/ethical...

CVE-2025-41045 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datasconfigethicallicensekey' parameter in /apprain/admin/config/ethical...

CVE-2025-41045

appRain CMF 4.0.5 contains a stored authenticated XSS flaw due to improper validation of input in data[sconfig][ethical_licensekey] at /apprain/admin/config/ethical. Impact is client-side script execution in victims’ browsers; no fixed version is listed. Remediation is not provided in the sources...

CVE-2025-41044 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataPagename' parameter in /apprain/page/manage-static-pages/create...

CVE-2025-41044 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataPagename' parameter in /apprain/page/manage-static-pages/create...

CVE-2025-41044

CVE-2025-41044 affects appRain CMF 4.0.5. A stored authenticated XSS exists due to improper validation of user input in the /apprain/page/manage-static-pages/create endpoint, specifically through the data[Page][name] parameter. Public sources consistently describe the vulnerability as cross-site ...

CVE-2025-41043 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAppReportCodeid' and 'dataAppReportCodename' parameters in /apprain/appreport/manage/...

CVE-2025-41043 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAppReportCodeid' and 'dataAppReportCodename' parameters in /apprain/appreport/manage/...

CVE-2025-41043

CVE-2025-41043 affects appRain CMF 4.0.5. A stored authenticated XSS flaw arises from insufficient validation of user input in the parameters data[AppReportCode][id] and data[AppReportCode][name] within the endpoint /apprain/appreport/manage/ . Exploitation could allow an attacker to inject scrip...

CVE-2025-41042 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataOptionmessage', 'dataOptionsubject' and 'dataOptiontemplatetype' parameters in /apprain/information/manage/emailtemplate/ad...

CVE-2025-41042

appRain CMF 4.0.5 is affected by a stored authenticated XSS in /apprain/information/manage/emailtemplate/add due to insufficient validation of input in data[Option][message], data[Option][subject], and data[Option][templatetype]. Impact cited includes cookie-based credential theft; exploitation s...

CVE-2025-41041 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datacode', 'datalang0key', 'datalang0value', 'datalang1key' and 'datatitle' parameters in /apprain/developer/language/default.x...

CVE-2025-41041 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datacode', 'datalang0key', 'datalang0value', 'datalang1key' and 'datatitle' parameters in /apprain/developer/language/default.x...

CVE-2025-41041

Summary of CVE-2025-41041 : A stored authenticated cross-site scripting (XSS) vulnerability exists in appRain CMF version 4.0.5. The issue arises from improper validation of user input in the parameters data[code], data[lang][0][key], data[lang][0][value], data[lang][1][key], and data[title] hand...

CVE-2025-41040 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datacode', 'datalang0key', 'datalang0value', 'datalang1key' and 'datatitle' parameters in /apprain/developer/language/lipsum.xm...

CVE-2025-41040 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datacode', 'datalang0key', 'datalang0value', 'datalang1key' and 'datatitle' parameters in /apprain/developer/language/lipsum.xm...