CVE-2025-57692

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 26, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-576976.5AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64. Since the _encode_image_bs64 function defin CVE-2025-576987.5AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface '/plugin/i CVE-2025-576998.4Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. A user w CVE-2025-57706.1A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of outpu CVE-2025-577006.1DIAEnergie - Stored Cross-site Scripting CVE-2025-577016.1DIAEnergie - Reflected Cross-site Scripting CVE-2025-577026.1DIAEnergie - Reflected Cross-site Scripting CVE-2025-577036.1DIAEnergie - Reflected Cross-site Scripting CVE-2025-577045.5Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerabili CVE-2025-577054.9An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If CVE-2025-577065.4A cross-site scripting (XSS) vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can t CVE-2025-577078.8An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File S