Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 38

Export CSV
CVE-2025-41033

SQL injection vulnerability in appRain CMF

An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BPage%5D%5Bname%5D' parameter in /apprain/page/manage-dynamic-pages/create.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2024-58279

appRain CMF 4.0.5 Authenticated Remote Code Execution via Filemanager Upload

appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by uploading a crafted PHP file to the site's uploads directory.

CVSS 4.0 · 8.6 High EPSS 1.0% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41042

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Option][message]', 'data[Option][subject]' and 'data[Option][templatetype]' parameters in /apprain/information/manage/emailtemplate/add.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41041

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[code]', 'data[lang][0][key]', 'data[lang][0][value]', 'data[lang][1][key]' and 'data[title]' parameters in /apprain/developer/language/default.xml.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41040

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[code]', 'data[lang][0][key]', 'data[lang][0][value]', 'data[lang][1][key]' and 'data[title]' parameters in /apprain/developer/language/lipsum.xml.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41039

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[sconfig][admin_landing_page]', 'data[sconfig][currency]', 'data[sconfig][db_version]', 'data[sconfig][default_pagination]', 'data[sconfig][emailsetup_from_email]', 'data[sconfig][emailsetup_host]', 'data[sconfig][emailsetup_password]', 'data[sconfig][emailsetup_port]', 'data[sconfig][emailsetup_username]', 'data[sconfig][fileresource_id]', 'data[sconfig][large_image_height]', 'data[sconfig][large_image_width]' and 'data[sconfig][time_zone_padding]' parameters in /apprain/admin/config/opts.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41038

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Group][name]' parameter in /apprain/admin/managegroup/add/.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41032

SQL injection vulnerability in appRain CMF

An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BAdmin%5D%5Busername%5D' parameter in /apprain/admin/manage/add/.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41034

SQL injection vulnerability in appRain CMF

An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BPage%5D%5Bname%5D' parameter in /apprain/page/manage-static-pages/create/.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41035

Path Traversal vulnerability in appRain CMF

A problem has been discovered in appRain CMF 4.0.5. An authenticated Path Traversal vulnerability in /apprain/common/download/ allows remote users to bypass the intended SecurityManager restrictions and download any file if they have adequate permissions outside the document root configured on the server via the base64 path after /download/.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41036

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the  'data[Admin][description]', 'data[Admin][f_name]' and 'data[Admin][l_name]' parameters in /apprain/admin/account/edit.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41037

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[FileManager][search]' parameter in /apprain/admin/filemanager.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41043

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[AppReportCode][id]' and 'data[AppReportCode][name]' parameters in /apprain/appreport/manage/.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41044

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Page][name]' parameter in /apprain/page/manage-static-pages/create.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41045

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[sconfig][ethical_licensekey]' parameter in /apprain/admin/config/ethical.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41046

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/960grid.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41047

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/ace.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41048

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/admin.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41049

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/appform.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain
CVE-2025-41050

Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/base_libs.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apprain
Products
Apprain