CVE-2025-69246
Lack of bruteforce protection in Raytha CMS
- State
- Published
- Severity
- 6.9 Medium
- Published
- Mar 16, 2026
- Updated
- Mar 16, 2026
- Reserved
- Dec 30, 2025
Description
Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automated logon requests without triggering lockout, throttling, or step-up challenges.
This issue was fixed in version 1.4.6.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected Products
| Product | Versions |
|---|---|
RaythaRaytha |
|
References
- https://cert.pl/en/posts/2026/03/CVE-2025-69236third-party-advisory
- https://raytha.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.