CVE-2026-24833

published 2026-01-28

CVE-2026-24833: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module…

Priority P4 29 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module could install with richtext in its description field which could contain scripts that will run for user in the Persona Bar. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
dnnsoftware	dnn.platform	< 9.13.10	9.13.10
dnnsoftware	dnn.platform	—	—
dnnsoftware	dotnetnuke	< 9.13.10	9.13.10
dnnsoftware	dotnetnuke	>= 10.0.0 < 10.2.0	10.2.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79