CVE-2025-69246 | THREATINT

Description

Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automated logon requests without triggering lockout, throttling, or step-up challenges. This issue was fixed in version 1.4.6.

PUBLISHED Reserved 2025-12-30 | Published 2026-03-16 | Updated 2026-03-16 | Assigner CERT-PL

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Problem types

CWE-307 Improper Restriction of Excessive Authentication Attempts

Product status

Default status

unaffected

Any version before 1.4.6

affected

Credits

Daniel Basta finder

References

cert.pl/en/posts/2026/03/CVE-2025-69236 third-party-advisory

raytha.com product

cve.org (CVE-2025-69246)

nvd.nist.gov (CVE-2025-69246)

Download JSON