CVE-2025-41059

appRain CMF 4.0.5 contains a stored authenticated XSS vulnerability in the endpoint /apprain/developer/addons/update/tablesorter, exploitable via the parameters data[Addon][layouts] and data[Addon][layouts_except]. The issue stems from improper validation of user input in this API path, allowing ...