Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-40980 State: PUBLISHED Published: 2025-07-31T09:46:07.541Z Last Updated: 2025-07-31T13:24:58.549Z Vendors: UltimateFosters Products: UltimatePOS Problem Types: CWE-79 Description: A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of user inputs via ‘/products/<PRODUCT_ID>/edit’, affecting to ‘name’ parameter via POST. The vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her session cookies details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/
details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-ultimatepos
CVE ID: CVE-2025-40985 State: PUBLISHED Published: 2025-07-16T09:27:41.306Z Last Updated: 2025-07-16T14:40:05.100Z Vendors: SCATI Products: SCATI Vision Web Problem Types: CWE-89 Description: SQL injection vulnerability in SCATI Vision Web of SCATI Labs from version 4.8 to 7.2. This vulnerability allows an attacker to exfiltrate some data from the database via the ‘login’ parameter in the endpoint ‘/scatevision_web/index.php/loginForm’. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-scati-vision-web
CVE ID: CVE-2025-40989 State: PUBLISHED Published: 2025-10-02T10:40:03.790Z Last Updated: 2025-10-02T14:09:15.512Z Vendors: Creativeitem Products: Ekushey CRM Problem Types: CWE-79 Description: Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_message/add/xxx", affecting to "message" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-creativeitem-products
CVE ID: CVE-2025-40990 State: PUBLISHED Published: 2025-10-02T10:42:05.027Z Last Updated: 2025-10-02T14:07:46.856Z Vendors: Creativeitem Products: Ekushey CRM Problem Types: CWE-79 Description: Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_bug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices
n details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-creativeitem-products
CVE ID: CVE-2025-40991 State: PUBLISHED Published: 2025-10-02T10:45:42.885Z Last Updated: 2025-10-02T15:53:10.996Z Vendors: Creativeitem Products: Ekushey CRM Problem Types: CWE-79 Description: Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_file/upload/xxxx", affecting to "description" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/mult
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-creativeitem-products
CVE ID: CVE-2025-40992 State: PUBLISHED Published: 2025-10-02T10:50:54.123Z Last Updated: 2025-10-02T15:52:59.775Z Vendors: Creativeitem Products: Sociopro Problem Types: CWE-79 Description: Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/update_profile', affecting to 'name' parameter via POST. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal his/her cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-creativeitem-products
CVE ID: CVE-2025-41000 State: PUBLISHED Published: 2025-09-03T11:04:01.811Z Last Updated: 2025-09-03T14:04:36.130Z Vendors: BoomCMS Products: BoomCMS Problem Types: CWE-1021 Description: Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends entirely on the browser chosen by the user, so it is perceived as a minor threat to web application security. This vulnerability only works in older browsers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/
rs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-boomcms
CVE ID: CVE-2025-41001 State: PUBLISHED Published: 2025-11-10T09:57:40.186Z Last Updated: 2025-11-10T12:50:32.728Z Vendors: SOPlanning Products: SOPlanning Problem Types: CWE-79 Description: Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUT_REDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notice
on details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-soplanning
CVE ID: CVE-2025-41009 State: PUBLISHED Published: 2025-10-27T11:35:35.426Z Last Updated: 2025-10-27T13:17:02.766Z Vendors: Disenno de Recursos Educativos S.L Products: virtual campus platform Problem Types: CWE-89 Description: SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the database by sending a POST request using the ‘buscame’ parameter in ‘/catalogo_c/catalogo.php’. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-virtual-campus-platform-diseno-de-recursos-educativos
CVE ID: CVE-2025-41010 State: PUBLISHED Published: 2025-10-02T12:22:32.030Z Last Updated: 2025-10-02T15:52:28.607Z Vendors: Hiberus Products: Sintra Problem Types: CWE-942 Description: Incorrect Cross-Origin Resource Sharing (CORS) configuration in Hiberus Sintra. Cross-Origin Resource Sharing (CORS) allows browsers to make cross-domain requests in a controlled manner. This request has an “Origin” header that identifies the domain making the initial request and defines the protocol between a browser and a server to see if the request is allowed. An attacker can exploit this and potentially perform privileged actions and access confidential information when Access-Control-Allow-Credentials is
and potentially perform privileged actions and access confidential information when Access-Control-Allow-Credentials is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-origin-resource-sharing-cors-hiberus-sintra
CVE ID: CVE-2025-41016 State: PUBLISHED Published: 2025-11-24T12:18:45.678Z Last Updated: 2025-11-24T13:11:29.745Z Vendors: Davantis Products: DFUSION Problem Types: CWE-862 Description: Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events through access to “/alarms/<ALARM_ID>/<MEDIA>”, where the “MEDIA” parameter can take the value of “snapshot” or “video.mp4”. These media files contain images recorded by security cameras in response to triggered alerts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilit
t Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dfusion-davantis
CVE ID: CVE-2025-41017 State: PUBLISHED Published: 2025-11-24T12:20:25.873Z Last Updated: 2025-11-24T12:20:25.873Z Vendors: Davantis Products: DFUSION Problem Types: CWE-862 Description: Inadequate access control vulnerability in Davantis DDFUSION v6.177.7, which allows unauthorised actors to retrieve perspective parameters from security camera settings by accessing “/cameras/<CAMERA_ID>/perspective”. References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dfusion-davantis
CVE ID: CVE-2025-41018 State: PUBLISHED Published: 2025-10-16T07:56:17.817Z Last Updated: 2025-10-16T13:35:08.374Z Vendors: Sergestec Products: Exito Problem Types: CWE-89 Description: SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in '/public.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sergestec-products
CVE ID: CVE-2025-41019 State: PUBLISHED Published: 2025-10-16T07:56:47.121Z Last Updated: 2025-10-16T15:36:56.185Z Vendors: Sergestec Products: SISTICK Problem Types: CWE-89 Description: SQL injection in Sergestec's SISTICK v7.2. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'id' parameter in '/index.php?view=ticket_detail'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sergestec-products
CVE ID: CVE-2025-41020 State: PUBLISHED Published: 2025-10-16T07:59:06.798Z Last Updated: 2025-10-16T15:36:50.159Z Vendors: Sergestec Products: Exito Problem Types: CWE-639 Description: Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other customers through the 'id' parameter in '/admin/ticket_a4.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sergestec-products
CVE ID: CVE-2025-41021 State: PUBLISHED Published: 2025-10-16T08:00:39.666Z Last Updated: 2025-10-16T15:36:43.731Z Vendors: Sergestec Products: SISTICK Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) in Sergestec's Exito v8.0, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'obs' parameter in '/admin/index.php?action=product_update'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabil
yst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sergestec-products
CVE ID: CVE-2025-41028 State: PUBLISHED Published: 2025-10-20T09:00:59.562Z Last Updated: 2025-10-20T12:42:02.576Z Vendors: Grupo Castilla Products: Epsilon RH Problem Types: CWE-89 Description: A SQL Injection vulnerability has been found in Epsilon RH by Grupo Castilla. This vulnerability allows an attacker to retrieve, create, update and delete database via sending a POST request using the parameter ‘sEstadoUsr’ in ‘/epsilonnetws/WSAvisos.asmx’. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-epsilon-rh
CVE ID: CVE-2025-41030 State: PUBLISHED Published: 2025-09-02T08:14:24.674Z Last Updated: 2025-09-02T13:47:18.316Z Vendors: T-INNOVA Products: Deporsite Problem Types: CWE-863 Description: Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to obtain information from other users via GET ‘/ajax/TInnova_v2/Integrantes_Recurso_v2_1/llamadaAjax/buscarPersona’ using the ‘dni’ parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-deporsite-t-innova
CVE ID: CVE-2025-41031 State: PUBLISHED Published: 2025-09-02T08:15:47.251Z Last Updated: 2025-09-02T13:46:07.481Z Vendors: T-INNOVA Products: Deporsite Problem Types: CWE-863 Description: Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnova_c/FotoUsuario/llamadaAjax/uploadImage’. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-deporsite-t-innova
CVE ID: CVE-2025-41032 State: PUBLISHED Published: 2025-09-04T11:06:27.229Z Last Updated: 2025-09-04T14:21:28.834Z Vendors: appRain Products: appRain CMF Problem Types: CWE-89 Description: An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BAdmin%5D%5Busername%5D' parameter in /apprain/admin/manage/add/. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41033 State: PUBLISHED Published: 2025-09-04T11:06:38.804Z Last Updated: 2025-09-04T14:21:08.124Z Vendors: appRain Products: appRain CMF Problem Types: CWE-89 Description: An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BPage%5D%5Bname%5D' parameter in /apprain/page/manage-dynamic-pages/create. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41034 State: PUBLISHED Published: 2025-09-04T11:06:52.468Z Last Updated: 2025-09-04T14:17:38.543Z Vendors: appRain Products: appRain CMF Problem Types: CWE-89 Description: An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BPage%5D%5Bname%5D' parameter in /apprain/page/manage-static-pages/create/. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41035 State: PUBLISHED Published: 2025-09-04T11:07:48.351Z Last Updated: 2025-09-04T14:16:10.456Z Vendors: appRain Products: appRain CMF Problem Types: CWE-22 Description: A problem has been discovered in appRain CMF 4.0.5. An authenticated Path Traversal vulnerability in /apprain/common/download/ allows remote users to bypass the intended SecurityManager restrictions and download any file if they have adequate permissions outside the document root configured on the server via the base64 path after /download/. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41036 State: PUBLISHED Published: 2025-09-04T11:09:16.832Z Last Updated: 2025-09-04T13:52:09.653Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Admin][description]', 'data[Admin][f_name]' and 'data[Admin][l_name]' parameters in /apprain/admin/account/edit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41037 State: PUBLISHED Published: 2025-09-04T11:09:32.721Z Last Updated: 2025-09-04T13:49:08.567Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[FileManager][search]' parameter in /apprain/admin/filemanager. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41038 State: PUBLISHED Published: 2025-09-04T11:09:46.208Z Last Updated: 2025-09-04T20:08:54.824Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Group][name]' parameter in /apprain/admin/managegroup/add/. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41039 State: PUBLISHED Published: 2025-09-04T11:09:58.944Z Last Updated: 2025-09-04T20:09:28.177Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[sconfig][admin_landing_page]', 'data[sconfig][currency]', 'data[sconfig][db_version]', 'data[sconfig][default_pagination]', 'data[sconfig][emailsetup_from_email]', 'data[sconfig][emailsetup_host]', 'data[sconfig][emailsetup_password]', 'data[sconfig][emailsetup_port]', 'data[sconfig][emailsetup_username]', 'data[sconfig][fileresource_
ilsetup_password]', 'data[sconfig][emailsetup_port]', 'data[sconfig][emailsetup_username]', 'data[sconfig][fileresource_id]', 'data[sconfig][large_image_height]', 'data[sconfig][large_image_width]' and 'data[sconfig][time_zone_padding]' parameters in /apprain/admin/config/opts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41040 State: PUBLISHED Published: 2025-09-04T11:10:26.901Z Last Updated: 2025-09-04T20:09:57.299Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[code]', 'data[lang][0][key]', 'data[lang][0][value]', 'data[lang][1][key]' and 'data[title]' parameters in /apprain/developer/language/lipsum.xml. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41041 State: PUBLISHED Published: 2025-09-04T11:10:38.775Z Last Updated: 2025-09-04T20:11:07.109Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[code]', 'data[lang][0][key]', 'data[lang][0][value]', 'data[lang][1][key]' and 'data[title]' parameters in /apprain/developer/language/default.xml. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41042 State: PUBLISHED Published: 2025-09-04T11:10:57.547Z Last Updated: 2025-09-04T20:11:32.309Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Option][message]', 'data[Option][subject]' and 'data[Option][templatetype]' parameters in /apprain/information/manage/emailtemplate/add. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41043 State: PUBLISHED Published: 2025-09-04T11:11:08.966Z Last Updated: 2025-09-04T13:44:06.970Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[AppReportCode][id]' and 'data[AppReportCode][name]' parameters in /apprain/appreport/manage/. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41044 State: PUBLISHED Published: 2025-09-04T11:11:26.782Z Last Updated: 2025-09-04T13:43:34.033Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Page][name]' parameter in /apprain/page/manage-static-pages/create. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41045 State: PUBLISHED Published: 2025-09-04T11:11:40.417Z Last Updated: 2025-09-04T13:19:12.966Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[sconfig][ethical_licensekey]' parameter in /apprain/admin/config/ethical. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41046 State: PUBLISHED Published: 2025-09-04T11:12:02.344Z Last Updated: 2025-09-04T13:18:34.566Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/960grid. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41047 State: PUBLISHED Published: 2025-09-04T11:12:14.227Z Last Updated: 2025-09-04T13:58:40.581Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/ace. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf