Paper/Archive/CVE-2025-69246

CVE-2025-69246

Raytha Raytha — Lack of bruteforce protection in Raytha CMS

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 32.8.328 × 206.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automated logon requests without triggering lockout, throttling, or step-up challenges. This issue was fixed in version 1.4.6.

Affected

ProductAffectedFixed inSource

Raytha< 1.4.61.4.6CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CERT-PL (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

writeupcert.pl/en/posts/2026/03/CVE-2025-69236 refraytha.com