Which versions of PostgreSQL are affected by EUVD-2026-40272?

Raytha CMS 1.5.2 contains a critical SQL injection vulnerability allowing unauthenticated remote attackers to directly compromise the underlying PostgreSQL database and extract stored credentials.

How to fix or mitigate EUVD-2026-40272?

Within 24 hours: Inventory all Raytha CMS 1.5.2 instances and isolate internet-facing deployments behind network segmentation; restrict OData API endpoint access to authorized networks only. Within 7 days: Request patch timeline and interim guidance from Raytha vendor; deploy Web Application Firewall (WAF) rules to block SQL keywords and special characters in OData filter parameters if operational controls are insufficient. Within 30 days: Apply vendor-released patch to all instances upon availability; perform forensic review of PostgreSQL audit logs for unauthorized query patterns; rotate all credentials managed or authenticated through affected Raytha instances.

PostgreSQL EUVD-2026-40272

Q: What is the CVSS score of EUVD-2026-40272?

EUVD-2026-40272 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-12076 CRITICAL

SQL Injection (CWE-89)

2026-06-30 CERT-PL

GHSA-mqq6-92qv-xfm9

SQLi PostgreSQL Raytha

9.3

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERT-PL) · only source for this CVE.

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 10:21 vuln.today

CVE Published

Jun 30, 2026 - 09:10 cve.org

CRITICAL 9.3

DescriptionCVE.org

Raytha CMS is vulnerable to SQL Injection within the OData filter parsing pipeline. The vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL statements against the underlying PostgreSQL database, leading to full database compromise, including credential extraction.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.5.2 but may also affect other versions.

Articles & Coverage 1

News Critical SQL Injection in Raytha CMS 1.5.2 / PostgreSQL - CVE-2026-12076 Jun 30, 2026

AnalysisAI

SQL injection in Raytha CMS 1.5.2 lets a remote, unauthenticated attacker inject arbitrary SQL through the OData filter parsing pipeline, yielding full compromise of the backing PostgreSQL database and extraction of stored credentials. The CVSS 4.0 base score is 9.3 (critical) with a fully network-reachable, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patch candidate.