CVE-2025-41054

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/cycle...

CVE-2025-41054

CVE-2025-41054 affects appRain CMF 4.0.5. It’s a stored authenticated XSS in /apprain/developer/addons/update/cycle via data[Addon][layouts] and data[Addon][layouts_except]. Reported exploitation status is not provided; CVSS indicates NETWORK, LOW attack complexity, and user interaction is REQUIR...

CVE-2025-41054 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/cycle...

appRain CMF 跨站脚本漏洞

appRain CMF is a content management framework. A cross-site scripting vulnerability exists in appRain CMF due to improper validation of user input in the /apprain/developer/addons/update/cycle endpoint. An attacker could use this vulnerability to steal a victim's cookie-based authentication...

Windows 10 chills out, gives sysadmins a break

A few short weeks ago, Microsoft launched the very latest version of its desktop operating system OS, Windows 11. In security terms, Windows 11 is very much Windows 10 with knobs on. Or what Spinal Taps Nigel Tufnel might describe as Windows 10 turned up to 11. Unlike Tufnels description of his...

Service worker meeting notes

On July 28th-29th we met up in the Mozilla offices in Toronto to discuss the core service worker spec. I'll try and cover the headlines here. Before I get stuck in to the meaty bits of the meeting, our intent here is to do what's best for developers and the future of the web, so if you disagree...

Nasty Security Bug Fixed in Android Lollipop 5.0

There is a vulnerability in Android versions below 5.0 that could allow an attacker to bypass ASLR and run arbitrary code on a target device under certain circumstances. The bug was fixed in Lollipop, the newest version of the mobile OS, released earlier this week. The vulnerability lies in...