CVE-2026-12076

9.3 Critique

Publiée le 30/06/2026 à 12:16 · Modifiée le 30/06/2026 à 16:16 · Analyse NVD reportée · Source : cvd@cert.pl

Description

Raytha CMS is vulnerable to SQL Injection within the OData filter parsing pipeline. The vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL statements against the underlying PostgreSQL database, leading to full database compromise, including credential extraction. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.5.2 but may also affect other versions.

Traduire en français

Produits concernés

Raytha

Scores CVSS

Version	Score	Source	Vecteur
4.0	9.3 Critique	cvd@cert.pl	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-89

Références

https://cert.pl/posts/2026/06/CVE-2026-12076
https://raytha.com

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories