EUVD-2025-26712

Malicious code in bioql PyPI...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the datasconfigethicallicensekey parameter in the /apprain/admin/config/ethical process. An attacker can execute arbitrary JavaScript code in the context of a user's browser by submitting crafted input that ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataFileManagersearch parameter in the /apprain/admin/filemanager process. An attacker can execute arbitrary JavaScript code in the context of a user's browser by submitting crafted input that is...

CVE-2025-41039: Improper Neutralization of Input During Web Page Generation

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datasconfigadminlandingpage', 'datasconfigcurrency', 'datasconfigdbversion', 'datasconfigdefaultpagination',...

CVE-2025-41032: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BAdmin%5D%5Busername%5D' parameter in /apprain/admin/manage/add/...

CVE-2025-41037: Improper Neutralization of Input During Web Page Generation

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataFileManagersearch' parameter in /apprain/admin/filemanager...

CVE-2025-41038: Improper Neutralization of Input During Web Page Generation

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataGroupname' parameter in /apprain/admin/managegroup/add/...

CVE-2025-41045: Improper Neutralization of Input During Web Page Generation

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datasconfigethicallicensekey' parameter in /apprain/admin/config/ethical...