Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2025-41038

Stored Cross-Site Scripting vulnerability in appRain CMF

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
INCIBE

Description

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Group][name]' parameter in /apprain/admin/managegroup/add/.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

appRain appRain CMF

Default version status: unaffected

  • 4.0.5affected

References