Piranha Cms
Approved changes feed: RSS · Atom
cpe:2.3:a:dotnetfoundation:piranha_cms:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Dotnetfoundation (e54dfb45-d6fd-5af7-9149-3f3dc521613a) |
|---|---|
| Product | Piranha Cms (b4f6b6b7-1837-5d44-9df4-79af6dad0f8d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/piranhacms/piranha.core |
purl2cpe | 2026-06-01 10:12:09.077521 |
pkg:nuget/Piranha |
purl2cpe | 2026-06-01 10:12:09.077524 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-111665 |
vulnerable | 2026-11-03 10:16:11.237032 |
Piranha CMS through 12.2 Missing Authorization in Manager Language API
MEDIUM (5.4)
Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.
Published: 2026-10-16T17:39:28.253Z
Updated: 2026-10-19T13:23:30.162Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25977 |
vulnerable | 2026-06-08 05:30:41.818452 |
Piranha CMS - Stored XSS in Page Title
MEDIUM (5.4)
In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.
Published: 2021-10-25T13:10:10.000Z
Updated: 2025-04-30T15:52:58.659Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25976 |
vulnerable | 2026-06-08 05:30:41.809989 |
Piranha CMS - Site-wide Cross-Site Request Forgery (CSRF)
HIGH (8.1)
In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
Published: 2021-11-16T09:05:12.000Z
Updated: 2025-04-30T15:46:50.534Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.