GHSA-456v-f425-8mcv

PiranhaCMS stored XSS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-57692

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	Piranha	<= 12.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-57692 advisory
https://github.com/PiranhaCMS/piranha.core package
https://github.com/PiranhaCMS/piranha.core/releases/tag/v12.0 web
https://github.com/Saconyfx/security-advisories/blob/main/CVE-2025-57692/advisory.md web