CVE-2025-69241
Stored XSS in Raytha CMS Profile Editing Allows Code Injection
Publication date: 2026-03-16
Last updated on: 2026-03-16
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| raytha | raytha | to 1.4.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in Raytha CMS is a Stored Cross-Site Scripting (XSS) issue that occurs via the FirstName and LastName parameters in the profile editing functionality.
An authenticated attacker can inject arbitrary HTML and JavaScript code into the website through these parameters.
This malicious code is then stored and executed whenever someone visits the edited profile page.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute malicious scripts in the context of the affected website.
Potential impacts include theft of user session cookies, defacement of the website, redirection to malicious sites, or performing actions on behalf of other users.
Since the attacker must be authenticated, the risk is limited to users with access, but it still poses a significant security threat.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Raytha CMS to version 1.4.6 or later, where the issue has been fixed.