CVE-2025-69238

Raytha CMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. Attacker can craft special website, which when visited by the authenticated victim, will automatically send POST request to the endpoint e. x. deletion of the data without enforcing token verification. This issue wa...

CVE-2025-69237

Raytha CMS is vulnerable to Stored XSS via FieldValues0.Value parameter in page creation functionality. Authenticated attacker with permissions to create content can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in versi...

CVE-2013-20006

Qool CMS contains multiple persistent cross-site scripting vulnerabilities in several administrative scripts where POST parameters are not properly sanitized before being stored and returned to users. Attackers can inject malicious JavaScript code through parameters like 'title', 'name', 'email',...

CVE-2025-69246

Raytha CMS (CVE-2025-69246) is affected by a lack of brute-force protection in login, allowing automated multiple logon attempts. The issue is addressed in version 1.4.6; users should upgrade to mitigate risk. If upgrading is not feasible, apply any provided workaround or vendor guidance (not det...

CVE-2025-69246 Lack of bruteforce protection in Raytha CMS

Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automated logon requests without triggering lockout, throttling, or step-up challenges. This issue was fixed in version 1.4.6...

CVE-2025-69245 Reflected XSS in Raytha CMS

Raytha CMS is vulnerable to Reflected XSS via returnUrl parameter in logon functionality. An attacker can craft a malicious URL which, when opened by the authenticated victim, results in arbitrary JavaScript execution in the victim’s browser. This issue was fixed in 1.4.6...

CVE-2025-69245

CVE-2025-69245 : Raytha CMS is affected by a reflected XSS via the returnUrl parameter in the logon flow. An attacker can craft a URL that, when opened by an authenticated user, may execute arbitrary JavaScript in the user’s browser. The issue has a fixed version: 1.4.6. The CVSS base score is 5....

CVE-2025-69245 Reflected XSS in Raytha CMS

Raytha CMS is vulnerable to Reflected XSS via returnUrl parameter in logon functionality. An attacker can craft a malicious URL which, when opened by the authenticated victim, results in arbitrary JavaScript execution in the victim’s browser. This issue was fixed in 1.4.6...

CVE-2025-69243 User enumeration in Raytha CMS

Raytha CMS is vulnerable to User Enumeration in password reset functionality. Difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins. This issue was fixed in version 1.5.0...

CVE-2025-69242 Reflected XSS in Raytha CMS

Raytha CMS is vulnerable to reflected XSS via the backToListUrl parameter. An attacker can craft a malicious URL which, when opened by authenticated victim, results in arbitrary JavaScript execution in the victim’s browser. This issue was fixed in version 1.4.6...

CVE-2025-69241

Raytha CMS is affected by CVE-2025-69241, a Stored XSS in the profile editing flow via FirstName/LastName. An authenticated attacker can inject HTML/JS that executes when the edited page is viewed. The issue has been fixed in version 1.4.6. The CVSSv4 metrics indicate a Medium impact (base score ...

CVE-2025-69241 Stored XSS in Raytha CMS

Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6...

CVE-2025-69241 Stored XSS in Raytha CMS

Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6...

CVE-2025-69240 Header Poisoning in Raytha CMS

Raytha CMS allows an attacker to spoof X-Forwarded-Host or Host headers to attacker controlled domain. The attacker who knows the victim's email address can force the server to send an email with password reset link pointing to the domain from spoofed header. When victim clicks the link, browser...

CVE-2025-69240

Raytha CMS contains a vulnerability where an attacker can spoof X-Forwarded-Host or Host headers to direct a password reset email to a attacker-controlled domain. If a victim clicks the reset link, the token is exposed to the attacker, enabling password reset and account takeover. The issue is do...

CVE-2025-69240 Header Poisoning in Raytha CMS

Raytha CMS allows an attacker to spoof X-Forwarded-Host or Host headers to attacker controlled domain. The attacker who knows the victim's email address can force the server to send an email with password reset link pointing to the domain from spoofed header. When victim clicks the link, browser...

CVE-2025-69239 Server-Site Request Forgery in Raytha CMS

Raytha CMS is vulnerable to Server-Side Request Forgery in the “Themes - Import from URL” feature. It allows an attacker with high privileges to provide the URL for redirecting server-side HTTP request. This issue was fixed in version 1.4.6...

CVE-2025-69239

Raytha CMS (affected component: Themes - Import from URL) is vulnerable to Server-Side Request Forgery. The vulnerability arises from allowing a high-privilege user to supply a URL for a server-side HTTP request, enabling potential unintended requests. The issue is fixed in version 1.4.6. The CVS...

CVE-2025-69239 Server-Site Request Forgery in Raytha CMS

Raytha CMS is vulnerable to Server-Side Request Forgery in the “Themes - Import from URL” feature. It allows an attacker with high privileges to provide the URL for redirecting server-side HTTP request. This issue was fixed in version 1.4.6...

CVE-2025-69238 Cross-Site Request Forgery in Raytha CMS

Raytha CMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. Attacker can craft special website, which when visited by the authenticated victim, will automatically send POST request to the endpoint e. x. deletion of the data without enforcing token verification. This issue wa...