CVE-2025-41033

CVE-2025-41033 is a critical SQL injection vulnerability affecting appRain CMF version 4.0.5. This flaw, located in the 'data%5BPage%5D%5Bname%5D' parameter within /apprain/page/manage-dynamic-pages/create, allows unauthenticated attackers to fully compromise the underlying database, enabling data retrieval, creation, updates, and deletion. With a CVSS score of 9.8 (Critical), it presents a severe risk due to its network-based attack vector, low attack complexity, and complete impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community attention with 10 mentions, indicating awareness among security researchers.