CVE-2023-4448

A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 4dff387283060961c362d50105ff8da8ea40bcbe. It is recommended to apply a patch to fix this issue. The identifier VDB-237569 was assigned to this vulnerability.

• CWE-640

• https://github.com/OpenRapid/rapidcms/commit/4dff387283060961c362d50105ff8da8ea40bcbe#diff-fc57d4c69cf5912c6edb5233c6df069a91106ebd481c115faf1ea124478b26d0Patch
• https://github.com/OpenRapid/rapidcms/issues/5Issue Tracking, Patch
• https://vuldb.com/?ctiid.237569Permissions Required, Third Party Advisory
• https://vuldb.com/?id.237569Third Party Advisory
• https://github.com/OpenRapid/rapidcms/commit/4dff387283060961c362d50105ff8da8ea40bcbe#diff-fc57d4c69cf5912c6edb5233c6df069a91106ebd481c115faf1ea124478b26d0Patch
• https://github.com/OpenRapid/rapidcms/issues/5Issue Tracking, Patch
• https://vuldb.com/?ctiid.237569Permissions Required, Third Party Advisory
• https://vuldb.com/?id.237569Third Party Advisory

Published

Aug 21, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-44474Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-44475Cross-Site Request Forgery (CSRF) vulnerability in Michael S…8.8
• CVE-2023-44476Cross-Site Request Forgery (CSRF) vulnerability in Andres Fe…8.8
• CVE-2023-44477Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulne…5.4
• CVE-2023-44478Cross-Site Request Forgery (CSRF) vulnerability in WP Hive E…7.1
• CVE-2023-44479Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-44480Leave Management System Project v1.0 is vulnerable to multip…8.8
• CVE-2023-44481Leave Management System Project v1.0 is vulnerable to multip…8.8
• CVE-2023-44482Leave Management System Project v1.0 is vulnerable to multip…8.8
• CVE-2023-44483All versions of Apache Santuario - XML Security for Java pri…6.5
• CVE-2023-44484Online Blood Donation Management System v1.0 is vulnerable t…6.1
• CVE-2023-44485Rejected reason: This CVE ID has been rejected or withdrawn …