Authenticated Reflected XSS in appRain CMF Affecting Multiple Versions

CVE-2025-41062

What is CVE-2025-41062?

A security flaw has been identified in appRain CMF version 4.0.5, which exposes users to authenticated reflected Cross-Site Scripting (XSS) attacks. This vulnerability arises from inadequate validation of user input, particularly through the 'page' parameter located in /apprain/developer/addons. Attackers could exploit this weakness to inject malicious scripts that may execute in the browsers of users with valid credentials, potentially leading to unauthorized actions and data exposure. Organizations using this version of appRain CMF should implement necessary security measures and consider updates to mitigate the risk.

References