GHSA-fw48-7qf9-455m

Piranha has stored cross-site scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2025-67290

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	Piranha	<= 12.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Excerpt field.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-67290 advisory
https://github.com/PiranhaCMS/piranha.core package
https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67290 web
http://piranha.com web