CVE-2025-69236
Stored XSS in Raytha CMS Post Editing Allows Script Injection
Publication date: 2026-03-16
Last updated on: 2026-03-16
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| raytha | raytha | to 1.4.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in Raytha CMS is a Stored Cross-Site Scripting (XSS) issue that occurs via the FieldValues[1].Value parameter in the post editing functionality.
An authenticated attacker who has permissions to edit posts can inject arbitrary HTML and JavaScript code into the website.
This malicious code will then be stored and executed whenever someone visits the edited page.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with post editing permissions to inject malicious scripts into the website.
When users visit the affected pages, the injected scripts can execute in their browsers, potentially leading to theft of user data, session hijacking, or other malicious activities.
It can undermine the trustworthiness and security of the website and its users.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Raytha CMS to version 1.4.6 or later, where the issue has been fixed.
Additionally, restrict post editing permissions to trusted users only, as the vulnerability requires authenticated users with edit permissions.