Stored Authenticated XSS in appRain CMF by appRain
CVE-2025-41059

5.1MEDIUM

Key Information:

Vendor

Apprain

Status
Apprain Cmf
Vendor
CVE Published:
4 September 2025

What is CVE-2025-41059?

A stored authenticated XSS vulnerability exists in appRain CMF version 4.0.5, resulting from insufficient validation of user inputs within specific parameters. This flaw could allow attackers to inject malicious scripts into the web application, compromising user data and web session integrity. Proper input validation and sanitization practices are crucial to mitigate this risk and enhance the overall security posture of the application.

Affected Version(s)

appRain CMF 4.0.5

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafael Pedrero
.
CVE-2025-41059 : Stored Authenticated XSS in appRain CMF by appRain