What is the CVSS score of EUVD-2025-208713?

EUVD-2025-208713 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Which versions of Raytha are affected by EUVD-2025-208713?

Organizations using Raytha CMS should be aware of notable risk from CVE-2025-69243 rated CVSS 6.9. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2025-208713?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Raytha EUVD-2025-208713

| CVE-2025-69243 MEDIUM

Observable Response Discrepancy (CWE-204)

2026-03-16 CERT-PL

Information Disclosure Raytha

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.5.0

EUVD ID Assigned

Mar 16, 2026 - 12:00 euvd

EUVD-2025-208713

Analysis Generated

Mar 16, 2026 - 12:00 vuln.today

CVE Published

Mar 16, 2026 - 11:54 nvd

MEDIUM 6.9

DescriptionCVE.org

Raytha CMS is vulnerable to User Enumeration in password reset functionality. Difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins.

This issue was fixed in version 1.5.0.

AnalysisAI

Raytha CMS contains a user enumeration vulnerability in its password reset functionality where differing error messages reveal whether a login exists in the system, enabling attackers to build valid user lists for targeted brute force attacks. This vulnerability affects Raytha CMS versions prior to 1.5.0. The moderate CVSS score of 6.9 reflects the information disclosure risk, though real-world impact depends on how attackers chain this enumeration with other attacks.

Technical ContextAI

The vulnerability stems from CWE-204 (Observable Discrepancy), a classic information disclosure weakness where an application provides different responses based on whether user input is valid. In Raytha CMS's password reset workflow, the system likely returns distinct error messages such as 'User not found' versus 'Password reset link sent' or similar variants. This allows an attacker to distinguish between valid and invalid usernames without authentication. The root cause is insufficient input validation and inadequate response normalization in the password reset endpoint, failing to follow security best practices that recommend identical responses for both valid and invalid inputs to prevent enumeration attacks.

RemediationAI

Upgrade Raytha CMS to version 1.5.0 or later immediately to resolve the user enumeration issue. Until patching can be completed, implement defensive measures including rate limiting on password reset endpoints (enforce CAPTCHA after 5 failed attempts), implement account lockout policies after multiple failed password reset requests, and enable monitoring and alerting for bulk password reset requests from single IP addresses. Additionally, consider implementing HTTPS-only access and restricting password reset functionality to authenticated sessions or adding email verification delays to reduce enumeration speed.