Stored Authenticated XSS in appRain CMF by appRain

CVE-2025-41051

What is CVE-2025-41051?

A vulnerability exists in appRain CMF version 4.0.5, allowing for stored authenticated cross-site scripting (XSS) attacks. This issue arises from inadequate validation of user input, particularly through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in the update functionality located at /apprain/developer/addons/update/bootstrap. Attackers may exploit this flaw to inject malicious scripts, which can be executed in the context of authorized users, leading to potential data compromise and user impersonation.

References