CVE-2025-41061 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/uploadify...

CVE-2025-41048

CVE-2025-41048 affects appRain CMF v4.0.5. A stored authenticated XSS exists due to insufficient validation of input in the parameters data[Addon][layouts] and data[Addon][layouts_except] at /apprain/developer/addons/update/admin. Reported details consistently identify the vulnerability as stored...