What is the CVSS score of EUVD-2025-208701?

EUVD-2025-208701 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N. EPSS exploitation probability: 0.0%.

Which versions of Raytha are affected by EUVD-2025-208701?

Organizations using Raytha CMS should be aware of moderate risk from CVE-2025-69237, a cross-site scripting vulnerability rated CVSS 5.1.. A patch is available.

How to fix or mitigate EUVD-2025-208701?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Raytha EUVD-2025-208701

| CVE-2025-69237 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-16 CERT-PL

XSS Authentication Bypass Raytha

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.4.6

EUVD ID Assigned

Mar 16, 2026 - 12:00 euvd

EUVD-2025-208701

Analysis Generated

Mar 16, 2026 - 12:00 vuln.today

CVE Published

Mar 16, 2026 - 11:53 nvd

MEDIUM 5.1

DescriptionCVE.org

Raytha CMS is vulnerable to Stored XSS via FieldValues[0].Value parameter in page creation functionality. Authenticated attacker with permissions to create content can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page.

This issue was fixed in version 1.4.6.

AnalysisAI

Raytha CMS contains a Stored Cross-Site Scripting (XSS) vulnerability in the page creation functionality through the FieldValues[0].Value parameter, allowing authenticated attackers with content creation permissions to inject malicious HTML and JavaScript that executes when other users visit the edited page. The vulnerability affects Raytha CMS versions prior to 1.4.6 and has a CVSS score of 5.1 with limited scope impact due to required authentication and user interaction. While not currently listed in CISA's Known Exploited Vulnerabilities catalog, the low attack complexity and availability of vendor patch make this a moderate but manageable risk for deployed instances.

Technical ContextAI

This vulnerability is an instance of Stored XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) in a content management system. Raytha CMS fails to properly sanitize or encode user-supplied input in the FieldValues parameter during page creation operations, allowing arbitrary HTML and JavaScript to be persisted in the database and subsequently rendered without proper output encoding. The root cause stems from insufficient input validation or lack of context-aware output encoding when page content is retrieved and displayed to end users. The vulnerability exists in Raytha CMS versions before 1.4.6, indicating the flaw has been present across multiple minor version releases. This type of stored XSS is particularly dangerous because the malicious payload is persistent and affects all users who view the compromised page, unlike reflected XSS which requires a crafted link.

RemediationAI

Upgrade Raytha CMS to version 1.4.6 or later immediately, which includes the fix for this stored XSS vulnerability. The upgrade process should follow the vendor's documented migration and backup procedures to prevent data loss. For organizations unable to patch immediately, implement compensating controls by restricting page creation permissions to a minimal set of trusted administrators, implementing Content Security Policy (CSP) headers with script-src restrictions, and enabling security auditing on all content modifications to detect suspicious activity. Additionally, enforce regular security reviews of published pages and consider implementing an approval workflow for page creation and modification to add a human review layer before content becomes publicly visible.