CVE-2025-15540

8.6 highEPSS 0.5%

High (8.6) in raytha raytha. EPSS 0.5% chance of exploitation in the next 30 days.

"Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxing or access restrictions, JavaScript code executed through Raytha’s “functions” feature can instantiate .NET components and perform arbitrary operations within the application’s hosting environment. This issue was fixed in version 1.4.6.

Severity

CVSS 4.0

8.6 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2026-03-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

raytha:raytha

References

https://cert.pl/en/posts/2026/03/CVE-2025-69236
https://raytha.com

Check your stack JSON