CVE-2025-64046 identifies a Cross Site Scripting (CWE-79) vulnerability in OpenRapid RapidCMS version 1.3.1, specifically in the /system/update-run.php file. The vulnerability allows remote attackers to execute scripts in the context of the victim's browser, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and affects confidentiality and integrity with no impact on availability.

Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected user's browser session, potentially leading to disclosure of sensitive information or manipulation of data accessible to the user. The impact is limited to confidentiality and integrity, with no direct availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is provided in the available data, users should monitor vendor communications for updates. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block XSS attempts targeting /system/update-run.php and restrict access to this endpoint if possible.