What is the CVSS score of CVE-2026-38930?

CVE-2026-38930 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

OpenRapid RapidCMS CVE-2026-38930

MEDIUM

SQL Injection (CWE-89)

2026-05-27 cve@mitre.org

PHP SQLi Authentication Bypass

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 17:28 vuln.today

CVSS changed

May 28, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

May 27, 2026 - 17:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component. This vulnerability is exploited via injecting a crafted SQL payload into the name cookie parameter.

AnalysisAI

Authentication bypass via SQL injection in OpenRapid RapidCMS v1.3.1 allows unauthenticated remote attackers to manipulate the application's authentication logic by injecting crafted SQL payloads into the name cookie parameter processed by the /template/default/menu.php component. The CVSS 6.5 (AV:N/AC:L/PR:N/UI:N) score reflects trivial remote exploitability with no prior authentication required, though the confidentiality and integrity impacts are rated Low and availability is unaffected. A public researcher writeup is linked in references, suggesting exploit techniques are documented, but no confirmed active exploitation (CISA KEV) has been recorded and EPSS sits at 0.03% (11th percentile), indicating low observed exploitation activity at time of analysis.

Technical ContextAI

RapidCMS is an open-source PHP-based content management system maintained by OpenRapid. The vulnerability resides in /template/default/menu.php, a front-end template component that processes the name cookie parameter. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause class, meaning the application directly concatenates or otherwise unsafely incorporates attacker-controlled cookie data into a SQL query without adequate parameterization, escaping, or input validation. Because this is a cookie parameter, the injection is delivered via the HTTP Cookie header rather than a URL query string or POST body, which may reduce detection coverage for WAF rules tuned to query-string or body injection patterns. The authentication bypass aspect indicates that the SQL injection is specifically able to subvert a query used in a login or session verification check - a classic UNION-based or boolean-based blind injection targeting an auth-gate query.

Affected ProductsAI

OpenRapid RapidCMS version 1.3.1 is the confirmed affected version per NVD and the researcher writeup referenced at https://moworn.github.io/post/cve-2026-38930/. No CPE string was provided in the source data. Vendor reference domains include http://openrapid.com and http://rapidcms.com, though no specific advisory pages were provided. Whether earlier versions of RapidCMS share the same vulnerable code path in /template/default/menu.php is not confirmed from available data.

RemediationAI

No vendor-released patch has been identified at time of analysis - no fixed version number appears in any of the provided references or NVD data. Organizations running OpenRapid RapidCMS v1.3.1 should monitor http://openrapid.com and http://rapidcms.com for a security release and consult the researcher writeup at https://moworn.github.io/post/cve-2026-38930/ for technical details that may inform interim mitigations. As a specific compensating control, restrict access to the /template/default/menu.php component at the web server or reverse proxy layer (e.g., block direct external requests to that path via nginx location deny or Apache mod_rewrite), noting that this may affect legitimate menu rendering functionality depending on application architecture. Additionally, deploy a WAF rule targeting SQL injection patterns within the Cookie header on requests to this path - be aware that cookie-header WAF coverage is less common in default rulesets and may require custom tuning. If the application is not internet-facing, network-level access restrictions to trusted IP ranges will substantially reduce exposure given the AV:N attack vector.