PT-2026-25688 · Raytha+1 · Raytha

Daniel Basta · CVE-2025-15540 · Publicado 2026-03-16 · Atualizado 2026-03-16

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Raytha CMS versions prior to 1.4.6

Description The “Functions” module in Raytha CMS permits users with elevated privileges to introduce custom code, extending the application’s capabilities. A deficiency in sandboxing or access controls allows JavaScript code executed via this feature to instantiate .NET components and carry out arbitrary operations within the application’s hosting environment. The affected module allows for the execution of arbitrary code.

Recommendations Update to version 1.4.6 or later.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2025-15540

Produtos afetados

Raytha

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15540.json · Exploit
• https://github.com/raythahq/raytha · Nota
• https://twitter.com/CVEnew/status/2033583660159684982 · Publicação no Twitter
• https://cert.pl/en/posts/2026/03/CVE-2025-69236 · Nota
• https://raytha.com · Nota
• https://osv.dev/vulnerability/CVE-2025-15540 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-15540 · Nota de Segurança