medium5.4
CVE-2021-25977
Cross-site Scripting in PiranhaCMS
Impact
In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Piranha | >= 7.0.0, < 9.2.0 | 9.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dotnetfoundation | Piranha Cms | from 7.0.0 through 9.1.1 |