CVE-2025-15540
"Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.48%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
"Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxing or access restrictions, JavaScript code executed through Raytha’s “functions” feature can instantiate .NET components and perform arbitrary operations within the application’s hosting environment. This issue was fixed in version 1.4.6.
- CVSS 4.0
- 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.48% probability · 40th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- raytha/raytha
- Source
- cvd@cert.pl
References
- https://cert.pl/en/posts/2026/03/CVE-2025-69236Third Party Advisory
- https://raytha.comProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.