CVE-2025-67290
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability exists in the Page Settings module of Piranha CMS v12.1. Attackers can inject malicious JavaScript or HTML into the Excerpt field, leading to script execution in victims' browsers.
Risk Assessment
The risk includes session hijacking, admin account takeover, and website defacement. This vulnerability could be leveraged to distribute malware within the organization.
Recommendation
Immediately update Piranha CMS to the latest version and apply input validation and output encoding for the Excerpt field. Additionally, implement a Content Security Policy (CSP).
Other vulnerabilities in Piranha CMS
See all- CVE-2026-111665Medium
Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.
- CVE-2025-67291Medium
A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to inject malicious JavaScript or HTML into the Name field, leading to script execution in victims' browsers.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Excerpt field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS