CVE-2025-69240
High · 8.8CVSS
8.8
EPSS
0.2%
Published
Mar 16, 2026
CISA due date
—
The record
Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker (who knows the victim's email address) can force the server to send an email with password reset link pointing to the domain from spoofed header. When victim clicks the link, browser sends request to the attacker’s domain with the token in the path allowing the attacker to capture the token. This allows the attacker to reset victim's password and take over the victim's account. This issue was fixed in version 1.4.6.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-112378 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before… CWE-348
- CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards. CWE-348
- CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-348
- CVE-2026-16732 fastify is a fast and low overhead web framework for Node.js. CWE-348
- CVE-2026-25552 Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated… CWE-348
- CVE-2026-63220 CodeIgniter is a PHP full-stack web framework. CWE-348
- CVE-2026-50243 In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with… CWE-348
- CVE-2026-63770 Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication… CWE-348