CVE-2025-64046
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in the /system/update-run.php file. This allows an attacker to inject malicious JavaScript code that can be executed in the victim's browser.
Risk Assessment
The risk includes session hijacking, credential theft, or unauthorized actions performed in the context of an authenticated administrator. This could lead to full compromise of the CMS system.
Recommendation
Immediately update RapidCMS to the latest patched version. If an update is not possible, restrict access to the /system/update-run.php file to trusted IP addresses only.
Other vulnerabilities in RapidCMS
See all- CVE-2026-38930Medium
An authentication bypass vulnerability was discovered in OpenRapid RapidCMS v1.3.1 within the /template/default/menu.php component. The flaw is exploited by injecting a crafted SQL payload into the 'name' cookie parameter.
- CVE-2025-64047Medium
OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php. This allows an attacker to inject malicious scripts into the page, which can be executed in the victim's browser.
Original NVD description (English source)
OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /system/update-run.php.