CVE-2025-69243 User enumeration in Raytha CMS

Medium 6.9 Published 16 Mar 2026 Updated 16 Mar 2026

Attackers can enumerate valid user accounts via password reset messages, facilitating targeted brute-force attacks against Raytha CMS.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-69243?

CVE-2025-69243 is a medium-severity vulnerability in Raytha, published on 16 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Raytha CMS is vulnerable to User Enumeration in password reset functionality. Difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins.

This issue was fixed in version 1.5.0.

Weakness: CWE-204

Which versions are affected by CVE-2025-69243?

It affects 1 product.

Products include Raytha Raytha.

How do I fix CVE-2025-69243?

No fix has been published for CVE-2025-69243 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-69243 being exploited?

There is no known exploitation of CVE-2025-69243 in the wild and no public exploit code.

Sources

Also known as GHSA-hhx9-gc5w-h4mc.