PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser.
CVE-2025-57692
CVSS base score
6.8 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-79
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Affected products
dotnetfoundation piranha cms
References
- github.com Release Notes
- github.com Exploit, Third Party Advisory