appRain vulnerabilities and threats

33 threats

Severity	CVSS	Signals	Threat	Source	Published
High	8.6	EPSS 1.0%	CVE-2024-58279appRain CMF · Unrestricted File Upload High8.6EPSS 1.0%2025-12-10CVE Database V5CVE-2024-58279 appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by uploading a crafted PHP file to the site's uploads directory. EPSS 1.0%Vulnerability CWE-434	CVE Database V5	2025-12-10
Medium	4.8	EPSS 0.2%	CVE-2025-41063appRain CMF · XSS or 'Cross-site Scripting' Medium4.8EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41063 A vulnerability has been discovered in version 4.0.5 of appRain CMF, consisting of an authenticated reflected XSS due to a lack of proper validation of user input, through the 's' parameter in /apprain/developer/debug-log/db. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	4.8	EPSS 0.2%	CVE-2025-41062appRain CMF · XSS or 'Cross-site Scripting' Medium4.8EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41062 A vulnerability has been discovered in version 4.0.5 of appRain CMF, consisting of an authenticated reflected XSS due to a lack of proper validation of user input, through the 'page' parameter in /apprain/developer/addons. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41061appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41061 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/uploadify. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41060appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41060 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/tree. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41059appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41059 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/tablesorter. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41058appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41058 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/row_manager. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41057appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41057 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/rich_text_editor. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41056appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41056 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/hysontable. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41055appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41055 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/dialogs. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41054appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41054 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/cycle. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41053appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41053 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/commonresource. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41052appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41052 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/canvasjs. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41051appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41051 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/bootstrap. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41050appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41050 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/base_libs. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41049appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41049 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/appform. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41048appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41048 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/admin. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41047appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41047 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/ace. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41046appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41046 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/960grid. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04
Medium	5.1	EPSS 0.2%	CVE-2025-41045appRain CMF · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-09-04CVE Database V5CVE-2025-41045 A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[sconfig][ethical_licensekey]' parameter in /apprain/admin/config/ethical. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-09-04

Page 1 of 2