Dotnetfoundation

Piranha Cms

8 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2025-67290

Exploit
  • EPSS 0.05%
  • Veröffentlicht 22.12.2025 00:00:00
  • Zuletzt bearbeitet 02.01.2026 17:43:02

A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Excerpt field.

6.1

CVE-2025-67291

Exploit
  • EPSS 0.05%
  • Veröffentlicht 22.12.2025 00:00:00
  • Zuletzt bearbeitet 02.01.2026 17:41:54

A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field.

6.1

CVE-2025-61413

Exploit
  • EPSS 0.09%
  • Veröffentlicht 23.10.2025 00:00:00
  • Zuletzt bearbeitet 31.12.2025 02:35:31

A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks.

6.8

CVE-2025-57692

Exploit
  • EPSS 0.04%
  • Veröffentlicht 26.09.2025 20:15:38
  • Zuletzt bearbeitet 07.10.2025 19:10:33

PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser.

4.7

CVE-2024-55341

Exploit
  • EPSS 0.08%
  • Veröffentlicht 20.12.2024 20:15:23
  • Zuletzt bearbeitet 21.04.2025 17:02:56

A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by creating a page via the /manager/pages and then adding a markdown content with the XSS payl...

4.7

CVE-2024-55342

Exploit
  • EPSS 0.08%
  • Veröffentlicht 20.12.2024 19:15:08
  • Zuletzt bearbeitet 18.04.2025 16:58:55

A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PDF can contain malicious JavaScript code, which is executed when a victim user opens or interacts with the PDF...

8.1

CVE-2021-25976

  • EPSS 0.1%
  • Veröffentlicht 16.11.2021 09:15:06
  • Zuletzt bearbeitet 21.11.2024 05:55:42

In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder et...

5.4

CVE-2021-25977

  • EPSS 0.32%
  • Veröffentlicht 25.10.2021 13:15:07
  • Zuletzt bearbeitet 21.11.2024 05:55:43

In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.