Dnnsoftware Dotnetnuke vulnerabilities

CVE-2025-64094 [MEDIUM] CVE-2025-64094: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft e DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios. This vulnerability exists because of an incomplete fix for CVE-2025-48378. This vulnerability is fixed in 10.1.1.

CVE-2025-52485 [MEDIUM] CWE-79 CVE-2025-52485: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft e DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue has been patched in version 10.0.1.

CVE-2025-59821 [MEDIUM] CWE-79 CVE-2025-59821: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft e DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. In these cases, the application does not sufficiently neutralize or

CVE-2020-37103 [MEDIUM] CWE-79 CVE-2020-37103: DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging

CVE-2025-59539 [MEDIUM] CWE-79 CVE-2025-59539: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft e DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile i

CVE-2025-48377 [MEDIUM] CWE-79 CVE-2025-48377: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft e DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions. Version 9.13.9 fixes the issue.

CVE-2025-48378 [MEDIUM] CWE-79 CVE-2025-48378: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft e DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.

CVE-2018-14486 [MEDIUM] CWE-79 CVE-2018-14486: DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML. DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.

CVE-2020-5186 [MEDIUM] CWE-79 CVE-2020-5186: DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2). DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).

CVE-2021-31858 [MEDIUM] CWE-79 CVE-2021-31858: DotNetNuke (DNN) 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user DotNetNuke (DNN) 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated users to inject arbitrary code via a crafted payload.

CVE-2022-2922 [MEDIUM] CWE-23 CVE-2022-2922: Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0. Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.

CVE-2016-7119 [MEDIUM] CWE-79 CVE-2016-7119: Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) b Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element.

CVE-2009-4109 [MEDIUM] CWE-200 CVE-2009-4109: The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing f The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing functionality related to determination of the need for an upgrade, which allows remote attackers to access version information and possibly other sensitive information.

CVE-2025-59546 [MEDIUM] CWE-79 CVE-2025-59546: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft e DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, administrators and content editors can set html in module titles that could include javascript which could be used for XSS based attacks. This issue has been patched in version 10.1.0.

CVE-2026-24784 [MEDIUM] CWE-79 CVE-2026-24784: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft e DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a content editor could inject scripts in module headers/footers that would run for other users. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

CVE-2025-62802 [MEDIUM] CWE-434 CVE-2025-62802: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft e DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1

CVE-2026-40305 [MEDIUM] CWE-285 CVE-2026-40305: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft e DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2 patches the issue.

CVE-2004-2323 [MEDIUM] CVE-2004-2323: DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to obtain sensi DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information, including the SQL server username and password, via a GET request for source or configuration files such as Web.config.

CVE-2020-11585 [MEDIUM] CWE-330 CVE-2020-11585: There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activi There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitra

CVE-2008-6542 [MEDIUM] CVE-2008-6542: Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files.