# Piranha (NuGet) vulnerabilities

8 known vulnerabilities (1 high, 7 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://www.nuget.org/packages/Piranha

## Advisories (8)

### [CVE-2025-67291](https://cve.now/CVE-2025-67291): A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web…

- Severity: Medium 6.1
- Published: Dec 22, 2025
- Affected: through 12.0.0.

### [CVE-2025-67290](https://cve.now/CVE-2025-67290): A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary…

- Severity: Medium 6.1
- Published: Dec 22, 2025
- Affected: through 12.0.0.

### [CVE-2025-61413](https://cve.now/CVE-2025-61413): A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute…

- Severity: Medium 6.1
- Published: Oct 23, 2025
- Affected: through 12.0.0.

### [CVE-2025-57692](https://cve.now/CVE-2025-57692): PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution…

- Severity: Medium 6.8
- Published: Sep 26, 2025
- Affected: through 12.0.

### [CVE-2024-55342](https://cve.now/CVE-2024-55342): A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media.

- Severity: Medium 4.7
- Published: Dec 20, 2024
- Affected: through 11.1.0.

### [CVE-2024-55341](https://cve.now/CVE-2024-55341): A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web…

- Severity: Medium 4.7
- Published: Dec 20, 2024
- Affected: through 11.1.0.

### [CVE-2021-25976](https://cve.now/CVE-2021-25976): Piranha CMS - Site-wide Cross-Site Request Forgery (CSRF)

- Severity: High 8.1
- Published: Nov 16, 2021
- Affected: from 4.0.0-alpha1, fixed in 10.0-alpha1.

### [CVE-2021-25977](https://cve.now/CVE-2021-25977): Piranha CMS - Stored XSS in Page Title

- Severity: Medium 5.4
- Published: Oct 25, 2021
- Affected: from 7.0.0, fixed in 9.2.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/nuget/piranha
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.