CVE-2025-61413
published 2025-10-23CVE-2025-61413: A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.26%
17.6th percentile
A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dotnetfoundation | piranha_cms | — | — |
| piranhacms | piranha | 0 – 12.0.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Piranha CMS vulnerable to stored cross-site scripting (XSS)
osv·2025-10-23
CVE-2025-61413 [MEDIUM] Piranha CMS vulnerable to stored cross-site scripting (XSS)
Piranha CMS vulnerable to stored cross-site scripting (XSS)
A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks.
GHSA
Piranha CMS vulnerable to stored cross-site scripting (XSS)
ghsa·2025-10-23
CVE-2025-61413 [MEDIUM] CWE-79 Piranha CMS vulnerable to stored cross-site scripting (XSS)
Piranha CMS vulnerable to stored cross-site scripting (XSS)
A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-23
Published