CVE-2025-67291: XSS
Published Dec 22, 2025
·Updated
A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field.
Affected Software
3 affected components
Piranha CMS Piranha CMS
nuget/Piranha<=12.0.0
Dotnetfoundation Piranha Cms=12.1
Event History
Dec 22, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·09:30 PM
Data Sourced
via GitHub·09:30 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-67291?
CVE-2025-67291 has a high severity rating due to its potential to allow attackers to execute arbitrary web scripts.
2
How do I fix CVE-2025-67291?
To fix CVE-2025-67291, upgrade Piranha CMS to version 12.1 or later that addresses the stored XSS vulnerability.
3
What impact does CVE-2025-67291 have on my Piranha CMS installation?
CVE-2025-67291 allows attackers to inject malicious scripts through the Media module, compromising the integrity of the application.
4
Is CVE-2025-67291 exploitable even with authentication?
Yes, CVE-2025-67291 is exploitable even by authenticated users, making it critical to address.
5
What versions of Piranha CMS are affected by CVE-2025-67291?
All versions of Piranha CMS up to and including 12.0.0 are affected by CVE-2025-67291.