Listen to this Post
How the CVE Works:
The vulnerability exists within the Page Settings module of Piranha CMS version 12.1. The ‘Excerpt’ input field does not properly sanitize or encode user-supplied data before storing it in the database. An attacker with permissions to edit page settings can inject a malicious JavaScript payload into this field. When the stored excerpt data is later retrieved and rendered on a public-facing webpage, the embedded script is executed in the browser of any visiting user. This occurs because the application treats the excerpt content as trusted HTML/script, allowing the payload to bypass standard output encoding. The attack is “stored” because the malicious code resides persistently within the CMS database.
DailyCVE Form:
Platform: Piranha CMS
Version: v12.1
Vulnerability : Stored XSS
Severity: Low
date: Dec 22, 2025
Prediction: Early Jan 2026
What Undercode Say:
Check installed Piranha version find . -name ".dll" | xargs strings | grep -i "piranha.12.1"
<!-- Example injected payload for Excerpt field --> <script>alert(document.cookie)</script>
How Exploit:
1. Authenticate to CMS.
2. Navigate to Page Settings.
3. Inject script into Excerpt field.
4. Save. Victim views page.
Protection from this CVE:
1. Input validation/sanitization.
2. Output encoding.
3. Implement Content Security Policy (CSP).
Impact:
1. Session hijacking.
2. Data theft.
3. Defacement.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
