Raytha vulnerabilities
We track 4 vulnerabilities in Raytha products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on June 30, 2026.
Latest Raytha vulnerabilities
- 9.3 Critical severity
Raytha: Improper Neutralization of Special Elements used in an SQL Command
Raytha CMS is vulnerable to SQL Injection within the OData filter parsing pipeline. The vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL statements against the underlying PostgreSQL database, leading to full database compromise,
- 9.8 Critical severity
Raytha: Improper Restriction of Excessive Authentication Attempts
Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automated logon requests without triggering lockout, throttling, or step-up challenges. This issue was fixed in version 1.4.6.
- 8.8 High severity
Raytha: Use of Less Trusted Source
Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker (who knows the victim's email address) can force the server to send an email with password reset link pointing to the domain from spoofed he
- 8.8 High severity
Raytha: Improper Control of Generation of Code
"Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxing or access restrictions, JavaScript code executed through Raytha’s “functions” feature can instantiate .NET components