6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67291

CVE-2025-67291: Piranha has stored cross-site scripting (XSS) vulnerability

A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67291

CVE-2025-67291:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Piranha	nuget	<= 12.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in Piranha CMS. The analysis of the commits between the vulnerable version (12.0.0) and the patched version (12.1) revealed a security fix in commit 0a1e5081b9e954856ad9fe641335ab049b27090d. This commit addresses an XSS vulnerability by adding input sanitization using DOMPurify.

The patch modifies the quote-block.vue and text-block.vue components. In quote-block.vue, the onAuthorBlur and onBodyBlur methods were vulnerable because they directly assigned user-provided innerText from a content-editable field to the data model. In text-block.vue, the v-model directive on a textarea was replaced with a new onChange method that sanitizes the input. These changes prevent attackers from injecting and storing malicious scripts.

While the vulnerability description specifies the 'Media module' and 'Name field', the identified patch applies to the 'quote' and 'text' content blocks. This suggests a possible discrepancy in the vulnerability's description in the advisory. However, the nature of the fix in the identified commit directly corresponds to a stored XSS vulnerability and is the only security-related change in the analyzed version range.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.