Vulnerabilities

TI-2026-29098 CVE-2026-40321 · GHSA-ffq7-898w-9jc4

DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload

MEDIUM 47

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1HIGH 8.1 Network Low privileges User interaction EPSS 0.06412 Published 2026-04-17 Fixed in 10.2.2 CWE-87

TI-2026-29084 CVE-2026-40306 · GHSA-2rhw-gw3f-477j

DNN has same HostGUID for all new installs

LOW 36

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00175 Published 2026-04-17 Fixed in 10.2.2 CWE-330

TI-2026-29083 CVE-2026-40305 · GHSA-fpj4-9qhx-5m6m

DNN has Force Friend Request Acceptance

LOW 19

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00183 Published 2026-04-17 Fixed in 10.2.2 CWE-285

TI-2020-19238 CVE-2020-37103 · GHSA-mwcw-c9qw-pvc9

DotNetNuke 9.5 - Persistent Cross-Site Scripting

LOW 23

DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00355 Published 2026-02-03 No fix listed CWE-79

TI-2026-20037 CVE-2026-24838 · GHSA-w9pf-h6m6-v89h

DotNetNuke.Core Vulnerable to Stored XSS via Module Title

MEDIUM 41

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00225 Published 2026-01-27 Fixed in 9.13.10, 10.2.0 CWE-79

TI-2026-20036 CVE-2026-24837 · GHSA-vm5q-8qww-h238

DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

LOW 35

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1HIGH 7.7 Network High privileges User interaction EPSS 0.00278 Published 2026-01-27 Fixed in 9.13.10, 10.2.0 CWE-79

TI-2026-20035 CVE-2026-24836 · GHSA-2g5g-hcgh-q3rp

DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

LOW 35

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1HIGH 7.7 Network High privileges User interaction EPSS 0.00257 Published 2026-01-27 Fixed in 9.13.10, 10.2.0 +1 CWE-79

TI-2026-20032 CVE-2026-24833

DotNetNuke.Core Vulnerable to Stored XSS in Module Description

LOW 35

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1HIGH 7.7 Network High privileges User interaction EPSS 0.00212 Published 2026-01-27 Fixed in 9.13.10, 10.2.0 CWE-79

TI-2026-19985 CVE-2026-24784 · GHSA-jjwg-4948-6wxp

DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer

LOW 29

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00195 Published 2026-01-27 Fixed in 9.13.10, 10.2.0 CWE-79

TI-2025-39546 CVE-2025-64095 · GHSA-3m8r-w7xg-jqvw

DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

HIGH 79

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.4697 Published 2025-10-28 Fixed in 10.1.1 CWE-434

TI-2025-39545 CVE-2025-64094 · GHSA-hmvq-8p83-cq52

DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

LOW 28

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00195 Published 2025-10-28 Fixed in 10.1.1 CWE-79

TI-2025-38985 CVE-2025-62802 · GHSA-2374-6cvw-qmx6

DNN CKEditor Provider allows unauthenticated upload out-of-the-box

LOW 20

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00233 Published 2025-10-28 Fixed in 10.1.1 CWE-1188

TI-2025-37078 CVE-2025-59548

DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser

LOW 26

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 4.0MEDIUM 5.9 Network High privileges User interaction EPSS 0.00188 Published 2025-09-23 Fixed in 10.1.0 CWE-79

TI-2025-37077 CVE-2025-59547

DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation

LOW 30

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00261 Published 2025-09-23 Fixed in 10.1.0 CWE-176

TI-2025-37260 CVE-2025-59821 · GHSA-jc4g-c8ww-5738

DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile

LOW 28

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00212 Published 2025-09-23 Fixed in 10.1.0 CWE-79

TI-2025-37076 CVE-2025-59546 · GHSA-gj8m-5492-q98h

DNN Vulnerable to Stored XSS Using Backend Admin Credentials

LOW 21

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00183 Published 2025-09-23 Fixed in 10.1.0 CWE-79

TI-2025-37075 CVE-2025-59545 · GHSA-2qxc-mf4x-wr29

DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module

MEDIUM 42

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00515 Published 2025-09-23 Fixed in 10.1.0 CWE-79

TI-2025-37069 CVE-2025-59539 · GHSA-7rcc-q6rq-jpcm

DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

LOW 27

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00183 Published 2025-09-23 Fixed in 10.1.0 CWE-79

TI-2025-37065 CVE-2025-59535 · GHSA-wq2j-w9pm-7x2p

DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters

LOW 35

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00428 Published 2025-09-22 Fixed in 10.1.0 CWE-20

TI-2025-32614 CVE-2025-52488 · GHSA-mgfv-2362-jq96

DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input

MEDIUM 63

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.35761 Published 2025-06-21 Fixed in 10.0.1 CWE-200

TI-2025-32613 CVE-2025-52487 · GHSA-fjhg-3mrh-mm7h

DNN.PLATFORM possibly allows bypass of IP Filters

LOW 38

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00349 Published 2025-06-21 Fixed in 10.0.1 CWE-863

TI-2025-32612 CVE-2025-52486 · GHSA-pf4h-vrv6-cmvr

DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects

LOW 27

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 4.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00229 Published 2025-06-21 Fixed in 10.0.1 CWE-79

TI-2025-32611 CVE-2025-52485 · GHSA-wwc9-wmm3-2pmf

DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

LOW 23

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00217 Published 2025-06-21 Fixed in 10.0.1 CWE-79

TI-2025-30703 CVE-2025-48377 · GHSA-79m3-rvx2-3qq9

Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode

LOW 26

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 4.0MEDIUM 6.0 Network Low privileges User interaction EPSS 0.00239 Published 2025-05-23 Fixed in 9.13.9 CWE-79

TI-2025-30704 CVE-2025-48378 · GHSA-m4hf-fxcg-cp34

Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline

LOW 27

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.

CVSS 4.0MEDIUM 6.1 Network Low privileges User interaction EPSS 0.00295 Published 2025-05-23 Fixed in 9.13.9 CWE-79