PT-2026-25688 · Raytha · Raytha

Daniel Basta · Published 2026-03-16 · Updated 2026-03-16 · CVE-2025-15540

Mitre

CVSS v4.0

8.6

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

"Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxing or access restrictions, JavaScript code executed through Raytha’s “functions” feature can instantiate .NET components and perform arbitrary operations within the application’s hosting environment.

This issue was fixed in version 1.4.6.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-15540

Affected Products

Raytha

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-15540 · Security Note
• https://twitter.com/CVEnew/status/2033583660159684982 · Twitter Post
• https://raytha.com · Note
• https://cert.pl/en/posts/2026/03/CVE-2025-69236 · Note