Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker (who knows the victim's email address) can force the server to send an email with password reset link pointing to the domain from spoofed header. When victim clicks the link, browser sends request to the attacker’s domain with the token in the path allowing the attacker to capture the token. This allows the attacker to reset victim's password and take over the victim's account. This issue was fixed in version 1.4.6.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-16 | 1 | Disclosure1 |
| 2026-03-17 | 1 | General1 |
CVE Alert: CVE-2025-69240 - Raytha - Raytha - https://www.redpacketsecurity.com/cve-alert-cve-2025-69240-raytha-raytha/ #OSINT #ThreatIntel #CyberSecurity #cve-2025-69240 #raytha #
Post summary
The post announces CVE-2025-69240 for Raytha and links to a CVE alert page, but it lacks details on exploitation, patches, or technical specifics.
CVE-2025-69240 Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker (who knows the victim's email address) can for… https://www.cve.org/CVERecord?id=CVE-2025-69240
Post summary
The text announces a CVE for Raytha CMS that enables header spoofing via `X-Forwarded-Host` or `Host` headers, but it does not provide PoC, exploit code, active exploitation, patch, or debunking information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | raytha | raytha | - | - | - |