CVE-2023-3852

A vulnerability was found in OpenRapid RapidCMS up to 1.3.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/upload.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4dff387283060961c362d50105ff8da8ea40bcbe. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-235204.

• CWE-434

• https://github.com/OpenRapid/rapidcms/commit/4dff387283060961c362d50105ff8da8ea40bcbePatch, VDB Entry
• https://github.com/OpenRapid/rapidcms/issues/1Exploit, Issue Tracking, Third Party Advisory
• https://vuldb.com/?ctiid.235204Permissions Required, Third Party Advisory
• https://vuldb.com/?id.235204Permissions Required, Third Party Advisory
• https://github.com/OpenRapid/rapidcms/commit/4dff387283060961c362d50105ff8da8ea40bcbePatch, VDB Entry
• https://github.com/OpenRapid/rapidcms/issues/1Exploit, Issue Tracking, Third Party Advisory
• https://vuldb.com/?ctiid.235204Permissions Required, Third Party Advisory
• https://vuldb.com/?id.235204Permissions Required, Third Party Advisory

Published

Jul 23, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38514Missing Authorization vulnerability in social share pro Soci…4.3
• CVE-2023-38515Server-Side Request Forgery (SSRF) vulnerability in Andy Moy…4.9
• CVE-2023-38516Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulne…5.4
• CVE-2023-38517Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-38518Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-38519Improper Neutralization of Special Elements used in an SQL C…4.9
• CVE-2023-38520External Control of Assumed-Immutable Web Parameter vulnerab…6.5
• CVE-2023-38521Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-38522Apache Traffic Server accepts characters that are not allowe…7.5
• CVE-2023-38523The web interface on multiple Samsung Harman AMX N-Series de…5.3
• CVE-2023-38524A vulnerability has been identified in Parasolid V34.1 (All …7.8
• CVE-2023-38525A vulnerability has been identified in Parasolid V34.1 (All …7.8