GHSA-3qcp-9v8c-6jp7

Piranha CMS vulnerable to stored cross-site scripting (XSS)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-61413

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	Piranha	<= 12.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-61413 advisory
https://github.com/PiranhaCMS/piranha.core package
https://github.com/Saconyfx/security-advisories/blob/main/CVE-2025-61413/advisory.md web
http://piranhacms.org web