CVE-2025-61413
MEDIUMPiranha CMS v12.0 - Stored Cross-Site Scripting in Markdown Blocks
Title source: llmDescription
A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks.
References (3)
Core 3
Core References
Product
http://piranhacms.org/
Exploit, Third Party Advisory
https://github.com/Saconyfx/security-advisories/blob/main/CVE-2025-61413/advisory.md
Scores
CVSS v3
6.1
EPSS
0.0005
EPSS Percentile
14.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (2)
dotnetfoundation/piranha_cms
12.0
nuget/Piranha
0NuGet
Published
Oct 23, 2025
Tracked Since
Feb 18, 2026