Priority CRITICAL 97KEV
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.94789 · Published 2017-07-20 · Fixed in 9.1.1 CWE-94
Priority CRITICAL 90KEV
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.74048 · Published 2019-07-03 · Fixed in 9.3.0 CWE-326
Priority CRITICAL 90KEV
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.76304 · Published 2019-07-03 · Fixed in 9.2.2 CWE-326
Priority HIGH 81
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.75119 · Published 2017-02-06 · Fixed in 7.4.1 CWE-264
Priority HIGH 79
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.4697 · Published 2025-10-28 · Fixed in 10.1.1 CWE-434
Priority HIGH 65
DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.54267 · Published 2019-07-03 · Fixed in 9.3.0 CWE-331
Priority MEDIUM 63
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.35761 · Published 2025-06-21 · Fixed in 10.0.1 CWE-200
Priority MEDIUM 63
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.47194 · Published 2019-07-03 · Fixed in 9.2.2 CWE-331
Priority MEDIUM 56
Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01292 · Published 2022-09-30 · Fixed in 9.11.0 CWE-23
Priority MEDIUM 48
** UNVERIFIABLE ** Unspecified vulnerability in an unspecified DNN Modules module for DotNetNuke (.net nuke) allows remote attackers to gain privileges via unspecified vectors, as used in an attack against the Microsoft…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.0245 · Published 2006-07-14 · No fix listed
Priority MEDIUM 47
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.
CVSS 3.1HIGH 8.1· Network · Low privileges · User interaction · EPSS 0.06412 · Published 2026-04-17 · Fixed in 10.2.2 CWE-87
Priority MEDIUM 47
DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.12543 · Published 2018-07-03 · Fixed in 9.2.0 CWE-918
Priority MEDIUM 43
DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02394 · Published 2020-02-24 · Fixed in 9.5.0 CWE-22
Priority MEDIUM 42
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.
CVSS 3.1CRITICAL 9.1· Network · Low privileges · User interaction · EPSS 0.00515 · Published 2025-09-23 · Fixed in 10.1.0 CWE-79
Priority MEDIUM 41
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.00225 · Published 2026-01-27 · Fixed in 9.13.10, 10.2.0 CWE-79
Priority LOW 38
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00349 · Published 2025-06-21 · Fixed in 10.0.1 CWE-863
Priority LOW 36
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00175 · Published 2026-04-17 · Fixed in 10.2.2 CWE-330
Priority LOW 36
Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.06152 · Published 2019-09-26 · Fixed in 9.4.0 CWE-79
Priority LOW 36
DotNetNuke 2.0 through 4.8.4 allows remote attackers to load .ascx files instead of skin files, and possibly access privileged functionality, via unknown vectors related to parameter validation.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.01402 · Published 2009-08-27 · No fix listed CWE-20
Priority LOW 35
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.
CVSS 3.1HIGH 7.7· Network · High privileges · User interaction · EPSS 0.00278 · Published 2026-01-27 · Fixed in 9.13.10, 10.2.0 CWE-79
Priority LOW 35
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.
CVSS 3.1HIGH 7.7· Network · High privileges · User interaction · EPSS 0.00257 · Published 2026-01-27 · Fixed in 9.13.10, 10.2.0 +1 CWE-79
Priority LOW 35
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.
CVSS 3.1HIGH 7.7· Network · High privileges · User interaction · EPSS 0.00212 · Published 2026-01-27 · Fixed in 9.13.10, 10.2.0 CWE-79
Priority LOW 35
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00428 · Published 2025-09-22 · Fixed in 10.1.0 CWE-20
Priority LOW 35
The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0115 · Published 2022-05-31 · Fixed in 9.11.0 CWE-918
Priority LOW 35
SQL injection vulnerability in DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to modify the backend database via the (1) table and (2) field parameters in LinkClick.aspx.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.01211 · Published 2005-08-16 · No fix listed
Load more
THREATIST.IORead the docs