CVE-2021-25976
Piranha CMS - Site-wide Cross-Site Request Forgery (CSRF)
In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Piranha CMS - Site-wide Cross-Site Request Forgery (CSRF)
In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
- Record
CVE-2021-25976- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2021-2374
In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
- Record
EUVD-2021-2374- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-ppq7-88c7-q879
Cross-Site Request Forgery in PiranhaCMS
In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
- Record
GHSA-ppq7-88c7-q879- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
NVD
In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
- Record
CVE-2021-25976- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - CVSS 2.0
- 4.0 Medium
AV:N/AC:H/Au:N/C:N/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
- Record
CVE-2021-25976- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-ppq7-88c7-q879
Cross-Site Request Forgery in PiranhaCMS
In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
- Record
GHSA-ppq7-88c7-q879- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
PiranhaNuGet |
4.0.0-alpha1 to 9.2.0 | 10.0-alpha1 |
PiranhaNuGet |
4.0.0-alpha1 up to 10.0-alpha1, plus listed versions 4.0.04.0.0-alpha34.0.0-alpha44.0.0-alpha54.0.0-alpha6 Show 45 moreShow less4.0.0-alpha74.0.0-alpha7-14.0.0-alpha84.0.0-alpha94.0.0-beta14.0.0-rc14.1.04.1.0-alpha14.1.0-beta14.1.0-beta24.1.14.2.04.2.0-alpha14.2.0-alpha24.2.0-beta14.2.14.3.04.3.0-beta15.0.05.0.0-alpha15.0.0-beta15.1.05.1.0-alpha15.1.0-alpha25.1.0-beta15.1.15.1.25.2.05.2.0-beta15.2.0-beta25.2.15.3.05.3.0-beta15.3.15.4.06.0.06.0.16.1.07.0.07.0.0-alpha17.0.0-alpha27.0.0-alpha37.0.0-beta17.0.0-rc17.0.1 |
10.0-alpha1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-25976 is a high vulnerability (CVSS 8.1) in Dotnetfoundation Piranha Cms, published November 16, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in Piranha 10.0-alpha1.
References
Left out here: 23 versions. The JSON record has them.