rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-40990 Stored XSS in Creativeitem Ekushey CRM
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_bug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Creativeitem
product: Ekushey CRM
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-10-02T10:42:05.027Z
CVE-2025-40991 Stored XSS in Creativeitem Ekushey CRM
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_file/upload/xxxx", affecting to "description" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Creativeitem
product: Ekushey CRM
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-10-02T10:45:42.885Z
CVE-2025-40992 Stored XSS in Creativeitem Sociopro
Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/update_profile', affecting to 'name' parameter via POST. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal his/her cookie session details.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Creativeitem
product: Sociopro
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-10-02T10:50:54.123Z
CVE-2025-41000 Cross-Frame Scripting (XFS) in BoomCMS
Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends entirely on the browser chosen by the user, so it is perceived as a minor threat to web application security. This vulnerability only works in older browsers.
Problem types: cwe_id: CWE-1021
description: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: BoomCMS
product: BoomCMS
default_status: unaffected
Credits: lang: en
value: Sergio Corchado Lucero
Published: 2025-09-03T11:04:01.811Z
CVE-2025-41001 Cross-Site Scripting (XSS) in SOPlanning
Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUT_REDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: SOPlanning
product: SOPlanning
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-11-10T09:57:40.186Z
CVE-2025-41002 SQL injection in Infoticketing
SQL injection vulnerability in Infoticketing. This vulnerability allows
 an unauthenticated attacker to retrieve, create, update, and delete the
 database by sending a POST request using the 'code' parameter in '/components/cart/cartApplyDiscount.php'.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MANANTIAL DE IDEAS
product: Infoticketing
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-02-23T09:30:22.990Z
CVE-2025-41003 Multiple vulnerabilities in Imaster products Open configuration options
Imaster's Patient Record Management System contains a stored Cross-Site Scripting (XSS) vulnerability in the endpoint ‘/projects/hospital/admin/edit_patient.php’. By injecting a malicious script into the ‘firstname’ parameter, the JavaScript code is stored and executed every time a user accesses the patient list, allowing an attacker to execute arbitrary JavaScript in a victim's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Imaster
product: Patient Record Management System
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-01-12T13:50:34.267Z
CVE-2025-41004 Multiple vulnerabilities in Imaster products Open configuration options
Imaster's Patient Records Management System is vulnerable to SQL Injection in the endpoint ‘/projects/hospital/admin/complaints.php’ through the ‘id’ parameter.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Imaster
product: Patient Record Management System
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-01-12T13:55:28.273Z
CVE-2025-41005 Multiple vulnerabilities in Imaster products Open configuration options
Imaster's MEMS Events CRM contains an SQL injection vulnerability in‘keyword’ parameter in ‘/memsdemo/exchange_offers.php’.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Imaster
product: MEMS Events CRM
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-01-12T14:35:20.087Z
CVE-2025-41006 Multiple vulnerabilities in Imaster products Open configuration options
Imaster's MEMS Events CRM contains an SQL injection vulnerability in ‘phone’ parameter in ‘/memsdemo/login.php’.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Imaster
product: MEMS Events CRM
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-01-12T14:39:11.953Z
CVE-2025-41007 SQL Injection in Cuantis
SQL Injection in Cuantis. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'search' parameter in the '/search.php' endpoint.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')
Affected products: vendor: Cuantis
product: Cuantis
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-03-23T12:08:17.388Z
CVE-2025-41008 SQL Injection in Sinturno
SQL injection vulnerability in Sinturno. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'client' parameter in the '/_adm/scripts/modalReport_data.php' endpoint.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')
Affected products: vendor: Sinturno
product: Sinturno
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-03-23T12:59:02.417Z
CVE-2025-41009 SQL injection on the virtual campus platform of Diseño de Recursos Educativos
SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the database by sending a POST request using the ‘buscame’ parameter in ‘/catalogo_c/catalogo.php’.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Disenno de Recursos Educativos S.L
product: virtual campus platform
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-10-27T11:35:35.426Z
CVE-2025-41010 Cross-origin resource sharing (CORS) in Hiberus Sintra
Incorrect Cross-Origin Resource Sharing (CORS) configuration in Hiberus Sintra. Cross-Origin Resource Sharing (CORS) allows browsers to make cross-domain requests in a controlled manner. This request has an “Origin” header that identifies the domain making the initial request and defines the protocol between a browser and a server to see if the request is allowed. An attacker can exploit this and potentially perform privileged actions and access confidential information when Access-Control-Allow-Credentials is enabled.
Problem types: cwe_id: CWE-942
description: CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains
Affected products: vendor: Hiberus
product: Sintra
default_status: unaffected
Credits: lang: en
value: Manuel Gomez Argandoña
Published: 2025-10-02T12:22:32.030Z
CVE-2025-41011 HTML injection in PHP Point Of Sale
HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: vendor: PHP Point Of Sale
product: PHP Point Of Sale
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-04-21T15:15:31.708Z
CVE-2025-41012 Unauthorized access vulnerability in TCMAN GIM
Unauthorized access vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system by using the 'pda:userId' and 'pda:newPassword' parameters with 'soapaction UnlockUser’ in '/WS/PDAWebService.asmx'.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: TCMAN
product: GIM
default_status: unaffected
Credits: lang: en
value: Hugo Leal Vara
Published: 2025-12-02T13:12:43.473Z
CVE-2025-41013 SQL injection vulnerability in TCMAN GIM
SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in '/PC/frmEPIS.aspx'.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: TCMAN
product: GIM
default_status: unaffected
Credits: lang: en
value: Hugo Leal Vara
Published: 2025-12-02T13:13:57.112Z
CVE-2025-41014 User Enumeration vulnerability in TCMAN GIM
User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetLastDatePasswordChange' in '/WS/PDAWebService.asmx'.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: TCMAN
product: GIM
default_status: unaffected
Credits: lang: en
value: Hugo Leal Vara
Published: 2025-12-02T13:18:13.267Z
CVE-2025-41015 User Enumeration vulnerability in TCMAN GIM
User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetUserQuestionAndAnswer' in '/WS/PDAWebService.asmx'.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: TCMAN
product: GIM
default_status: unaffected
Credits: lang: en
value: Hugo Leal Vara
Published: 2025-12-02T13:18:25.486Z
CVE-2025-41016 Multiple vulnerabilities in DFUSION by Davantis
Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events through access to “/alarms/<ALARM_ID>/<MEDIA>”, where the “MEDIA” parameter can take the value of “snapshot” or “video.mp4”. These media files contain images recorded by security cameras in response to triggered alerts.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Davantis
product: DFUSION
default_status: unaffected
Credits: lang: en
value: Ferran Plaza
Published: 2025-11-24T12:18:45.678Z
CVE-2025-41017 Multiple vulnerabilities in DFUSION by Davantis
Inadequate access control vulnerability in Davantis DDFUSION v6.177.7, which allows unauthorised actors to retrieve perspective parameters from security camera settings by accessing “/cameras/<CAMERA_ID>/perspective”.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Davantis
product: DFUSION
default_status: unaffected
Credits: lang: en
value: Ferran Plaza
Published: 2025-11-24T12:20:25.873Z
CVE-2025-41018 SQL injection vulnerability in Sergestec's Exito
SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in '/public.php'.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Sergestec
product: Exito
default_status: unaffected
Credits: lang: en
value: Ignacio Aldarabi
Published: 2025-10-16T07:56:17.817Z
CVE-2025-41019 SQL injection vulnerability in Sergestec's Exito
SQL injection in Sergestec's SISTICK v7.2. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'id' parameter in '/index.php?view=ticket_detail'.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Sergestec
product: SISTICK
default_status: unaffected
Credits: lang: en
value: Ignacio Aldarabi
Published: 2025-10-16T07:56:47.121Z
CVE-2025-41020 Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito
Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other customers through the 'id' parameter in '/admin/ticket_a4.php'.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Sergestec
product: Exito
default_status: unaffected
Credits: lang: en
value: Ignacio Aldarabi
Published: 2025-10-16T07:59:06.798Z
CVE-2025-41021 Stored Cross-Site Scripting (XSS) vulnerability in Sergestec's Exito
Stored Cross-Site Scripting (XSS) in Sergestec's Exito v8.0, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'obs' parameter in '/admin/index.php?action=product_update'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Sergestec
product: SISTICK
default_status: unaffected
Credits: lang: en
value: Ignacio Aldarabi
Published: 2025-10-16T08:00:39.666Z
CVE-2025-41023 Authentication bypass in AutoGPT de Thesamur
An authentication bypass vulnerability has been found in Thesamur's AutoGPT. This vulnerability allows an attacker to bypass authentication mechanisms. Once inside the web application, the attacker can use any of its features regardless of the authorisation method used.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Thesamur
product: AutoGPT
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-02-19T08:50:36.880Z
CVE-2025-41024 Stored Cross-Site Scripting in Poultry Farm Management System
Stored Cross-Site Scripting (XSS) in Poultry Farm Management System v1.0 due to the lack of proper validation of user input by sending a POST request. The relationship between parameters and assigned identifiers is as follows: 

'companyaddress', 'companyemail', 'companyname', 'country', 'mobilenumber' y 'regno' parameters in '/farm/farmprofile.php'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Poultry Farm Management System
product: Poultry Farm Management System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2026-01-20T11:35:31.066Z
CVE-2025-41025 Stored Cross-Site Scripting in Poultry Farm Management System
Stored Cross-Site Scripting (XSS) in Poultry Farm Management System v1.0 due to the lack of proper validation of user input by sending a POST request. The relationship between parameters and assigned identifiers is as follows:  

'category' y 'product' parameters in '/farm/sell_product.php'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Poultry Farm Management System
product: Poultry Farm Management System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2026-01-20T12:04:05.614Z
CVE-2025-41026 Multiple vulnerabilities in GDTaller
Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser  by sending a malicious URL in 'site' parameter in 'app_login.php'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: GDTaller
product: GDTaller
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-03-26T12:31:53.316Z
CVE-2025-41027 Multiple vulnerabilities in GDTaller
Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser by sending a malicious URL in  'site' parameter in 'app_recuperarclave.php'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: GDTaller
product: GDTaller
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-03-26T12:42:05.425Z
CVE-2025-41028 SQL injection in Epsilon RH
A SQL Injection vulnerability has been found in Epsilon RH by Grupo Castilla. This vulnerability allows an attacker to retrieve, create, update and delete database via sending a POST request using the parameter ‘sEstadoUsr’ in ‘/epsilonnetws/WSAvisos.asmx’.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Grupo Castilla
product: Epsilon RH
default_status: unaffected
Credits: lang: en
value: Pedro Gabaldón Juliá
lang: en
value: Javier Medina Munuera
lang: en
value: Antonio José Gálvez Sánchez
lang: en
value: Alejandro Baño Andrés
lang: en
value: Álvaro Piñero Laorden
Published: 2025-10-20T09:00:59.562Z
CVE-2025-41029 SQL injection in Zeon Academy Pro by Zeon Global Tech
SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameter 'phonenumber' in '/private/continue-upload.php'.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')
Affected products: vendor: Zeon Global Tech
product: Zeon Academy Pro
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-04-21T14:59:40.481Z
CVE-2025-41030 Multiple vulnerabilities in Deporsite by T-INNOVA
Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to obtain information from other users via GET ‘/ajax/TInnova_v2/Integrantes_Recurso_v2_1/llamadaAjax/buscarPersona’ using the ‘dni’ parameter.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: T-INNOVA
product: Deporsite
default_status: unaffected
Credits: lang: en
value: Héctor Sarrión
Published: 2025-09-02T08:14:24.674Z
CVE-2025-41031 Multiple vulnerabilities in Deporsite by T-INNOVA
Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnova_c/FotoUsuario/llamadaAjax/uploadImage’.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: T-INNOVA
product: Deporsite
default_status: unaffected
Credits: lang: en
value: Héctor Sarrión
Published: 2025-09-02T08:15:47.251Z
CVE-2025-41032 SQL injection vulnerability in appRain CMF
An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BAdmin%5D%5Busername%5D' parameter in /apprain/admin/manage/add/.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: appRain
product: appRain CMF
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-09-04T11:06:27.229Z
CVE-2025-41033 SQL injection vulnerability in appRain CMF
An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BPage%5D%5Bname%5D' parameter in /apprain/page/manage-dynamic-pages/create.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: appRain
product: appRain CMF
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-09-04T11:06:38.804Z
CVE-2025-41034 SQL injection vulnerability in appRain CMF
An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BPage%5D%5Bname%5D' parameter in /apprain/page/manage-static-pages/create/.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: appRain
product: appRain CMF
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-09-04T11:06:52.468Z
CVE-2025-41035 Path Traversal vulnerability in appRain CMF
A problem has been discovered in appRain CMF 4.0.5. An authenticated Path Traversal vulnerability in /apprain/common/download/ allows remote users to bypass the intended SecurityManager restrictions and download any file if they have adequate permissions outside the document root configured on the server via the base64 path after /download/.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: appRain
product: appRain CMF
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-09-04T11:07:48.351Z