CVE-2025-41032 is a critical SQL injection (CVSS 9.8) in appRain CMF 4.0.5. Input to the username field when adding an admin record reaches the database unsafely, so an attacker can read and change data. INCIBE reported no solution at publication, so lock down access and check for a newer release.
What's affected
The CVE record names appRain CMF 4.0.5. The weak input is the username field when adding an admin record, handled at /apprain/admin/manage/add/.
This is one of three SQL injection entries released together. The others are CVE-2025-41033 and CVE-2025-41034, each tied to a different form field. INCIBE coordinated 32 vulnerabilities in this product in total, with four rated high and 28 medium under its CVSS v4.0 scoring.
INCIBE states that no solution had been reported when the notice went out. I could not confirm a fixed version, so check the project site before you assume one exists.
How to check if you're exposed
Confirm which version of appRain CMF you run. The version is shown in the admin area and in the files you deployed. Version 4.0.5 is the one named in the record.
Then look at your web server logs for POST requests to /apprain/admin/manage/add/ that carry odd characters or very long values, and for repeated database errors after those requests. Also check who has an account for the admin area. INCIBE lists low privileges in its vector, while NVD scores the flaw with none, so plan for both.
If the CMS is exposed to the internet, move that question to the top of the list.
What to do now
- Inventory every appRain CMF site and its version.
- Limit access to /apprain/admin and the page management paths by IP address or VPN.
- Check the project for a release newer than 4.0.5 and read its notes before upgrading.
- Remove unused admin accounts and rotate passwords for those that remain.
- If no fix appears, plan a move to a maintained CMS, and in the meantime use a web application firewall in front of the site.
Why it matters
CWE-89, SQL injection, happens when user supplied text becomes part of a database command. A form field should only ever be data. Here it can change the query, and the record says the attacker could retrieve, create, update and delete the database.
The CVE is not in the CISA Known Exploited Vulnerabilities list. Projects with no maintainer response are a real risk for teams that run them for years. A flaw with no fix does not go away, so the plan has to be containment first and replacement second.
Try it yourself
If you maintain a fork or a plugin, source code scanning finds this class of bug before it ships. This demo shows how a code scan reads.
Click through it at your own pace, or open it full screen.
Quick check
Is there a fix for CVE-2025-41032?
INCIBE said no solution had been reported at publication, and I could not confirm one. Check the appRain project directly.
Does this affect appRain versions other than 4.0.5?
The record names only 4.0.5. Other versions may share the same code, so test or ask the maintainers instead of assuming you are clear.
Sources
Last reviewed: 18 October 2026.
