PatchTheCVEraytha vulnerabilities and fixes
Recent CVEs affecting raytha, with upgrade or downgrade steps. 11 tracked.
raytha has 11 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 11. Most recent: 2026-03-16. Highest priority: CVE-2025-69246 (score 47/100).
- CVE-2025-69246 CRITICAL 9.8 UPGRADE Raytha CMS does not have any brute force protection mechanism implemented
- CVE-2025-69245 MEDIUM 6.1 UPGRADE Raytha CMS is vulnerable to Reflected XSS via returnUrl parameter in logon functionality
- CVE-2025-69243 MEDIUM 5.3 UPGRADE Raytha CMS is vulnerable to User Enumeration in password reset functionality
- CVE-2025-69242 MEDIUM 6.1 UPGRADE Raytha CMS is vulnerable to reflected XSS via the backToListUrl parameter
- CVE-2025-69241 MEDIUM 5.4 UPGRADE Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality
- CVE-2025-69240 HIGH 8.8 UPGRADE Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain
- CVE-2025-69239 LOW 2.7 UPGRADE Raytha CMS is vulnerable to Server-Side Request Forgery in the “Themes - Import from URL” feature
- CVE-2025-69238 MEDIUM 4.3 UPGRADE Raytha CMS is vulnerable to Cross-Site Request Forgery across multiple endpoints
- CVE-2025-69237 MEDIUM 5.4 UPGRADE Raytha CMS is vulnerable to Stored XSS via FieldValues[0].Value parameter in page creation functionality
- CVE-2025-69236 MEDIUM 5.4 UPGRADE Raytha CMS is vulnerable to Stored XSS via FieldValues[1].Value parameter in post editing functionality
- CVE-2025-15540 HIGH 8.8 UPGRADE "Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to applicat
FAQ
How do I fix raytha vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is raytha being exploited right now?
None of the tracked raytha CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which raytha CVE should I patch first?
CVE-2025-69246 currently ranks highest (47/100): Raytha CMS does not have any brute force protection mechanism implemented.