appRain vulnerabilities
We track 4 vulnerabilities in appRain products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on December 10, 2025.
Latest appRain vulnerabilities
- 8.8 High severity
appRain CMF: Unrestricted Upload of File with Dangerous Type
appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with com
- 9.8 Critical severity
appRain CMF: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BPage%5D%5Bname%5D' parameter in /apprain/page/manage-static-pages/create/.
- 9.8 Critical severity
appRain CMF: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BPage%5D%5Bname%5D' parameter in /apprain/page/manage-dynamic-pages/create.
- 9.8 Critical severity
appRain CMF: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BAdmin%5D%5Busername%5D' parameter in /apprain/admin/manage/add/.