CVE-2025-15540 — Authenticated RCE in Raytha CMS
"Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxing or access restrictions, JavaScript…
Published: 2026-03-16 · CVSS: 8.6 · CVSS 4.0
"Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxing or access restrictions, JavaScript code executed through Raytha’s “functions” feature can instantiate .NET components and perform arbitrary operations within the application’s hosting environment. This issue was fixed in version 1.4.6.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7