Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
80 results · page 1 of 2
Apr 17, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-40321 · Other software · dnnsoftware · reported by GitHubHigh 8
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-40306 · Other software · dnnsoftware · reported by GitHubMedium 6.9
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have the same Host GUID. This does not affect upgrades from 9.x.x. Version 10.2.2 patches the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-40305 · Other software · dnnsoftware · reported by GitHubMedium 4.3
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2 patches the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through jCVE-2020-37103 · Other software · Dnnsoftware · reported by VulnCheckMedium 5.1
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks.
- Product
- DotNetNuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddnnsoftware.commedium.com
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24838 · Other software · dnnsoftware · reported by GitHubCritical 9.1
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24837 · Other software · dnnsoftware · reported by GitHubHigh 7.6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a module friendly name could include scripts that will run during some module operations in the Persona Bar. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24836 · Other software · dnnsoftware · reported by GitHubHigh 7.6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24833 · Other software · dnnsoftware · reported by GitHubHigh 7.6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module could install with richtext in its description field which could contain scripts that will run for user in the Persona Bar. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24784 · Other software · dnnsoftware · reported by GitHubMedium 6.8
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a content editor could inject scripts in module headers/footers that would run for other users. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-64095 · Other software · dnnsoftware · reported by GitHubCritical 10
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-64094 · Other software · dnnsoftware · reported by GitHubMedium 6.4
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios. This vulnerability exists because of an incomplete fix for CVE-2025-48378. This vulnerability is fixed in 10.1.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-62802 · Other software · dnnsoftware · reported by GitHubMedium 4.3
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59821 · Other software · dnnsoftware · reported by GitHubMedium 6.5
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. In these cases, the application does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim’s browser to interpret attacker-controlled content as part of the page’s HTML. This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59548 · Other software · dnnsoftware · reported by GitHubMedium 5.9
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, specially crafted URLs to the FileBrowser are vulnerable to javascript injection, affecting any unsuspecting user clicking such link. This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59547 · Other software · dnnsoftware · reported by GitHubMedium 5.3
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the CKEditor file upload endpoint has insufficient sanitization for filenames allowing probing network endpoints. A specially crafted request can be made to upload a file with Unicode characters, which would be translated into a path that could expose resources in the internal network of the hosted site. This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59546 · Other software · dnnsoftware · reported by GitHubLow 2.4
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, administrators and content editors can set html in module titles that could include javascript which could be used for XSS based attacks. This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59545 · Other software · dnnsoftware · reported by GitHubCritical 9
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution (XSS). This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59539 · Other software · dnnsoftware · reported by GitHubMedium 6.3
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59535 · Other software · dnnsoftware · reported by GitHubMedium 6.5
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-52488 · Other software · dnnsoftware · reported by GitHubHigh 8.6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-52487 · Other software · dnnsoftware · reported by GitHubHigh 8.8
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 7.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request or proxy to be created that could bypass the design of DNN Login IP Filters allowing login attempts from IP Addresses not in the allow list. This issue has been patched in version 10.0.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-52486 · Other software · dnnsoftware · reported by GitHubMedium 6.1
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows specially crafted content in URLs to be used with TokenReplace and not be properly sanitized by some SkinObjects. This issue has been patched in version 10.0.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-52485 · Other software · dnnsoftware · reported by GitHubMedium 5.1
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue has been patched in version 10.0.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-48378 · Other software · dnnsoftware · reported by GitHubMedium 6.1
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-48377 · Other software · dnnsoftware · reported by GitHubMedium 6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions. Version 9.13.9 fixes the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-48376 · Other software · dnnsoftware · reported by GitHubLow 3.5
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a malicious SuperUser (Host) could craft a request to use an external url for a site export to then be imported. Version 9.13.9 fixes the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-32374 · Other software · dnnsoftware · reported by GitHubMedium 5.9
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Possible denial of service with specially crafted information in the public registration form. This vulnerability is fixed in 9.13.8.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-32373 · Other software · dnnsoftware · reported by GitHubMedium 6.5
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not have access to. This vulnerability is fixed in 9.13.8.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-32372 · Other software · dnnsoftware · reported by GitHubMedium 6.5
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-32371 · Other software · dnnsoftware · reported by GitHubMedium 4.3
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the resulting image and a user that trusts the domain might think that the information is legitimate. This vulnerability is fixed in 9.13.4.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-32036 · Other software · dnnsoftware · reported by GitHubMedium 4.2
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. The algorithm used to generate the captcha image shows the least complexity of the desired image. For this reason, the created image can be easily read by OCR tools, and the intruder can send automatic requests by building a robot and using this tool. This vulnerability is fixed in 9.13.8.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-32035 · Other software · dnnsoftware · reported by GitHubLow 2.6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when uploading assets), the file extension is checked to see if it's an allowed file type but the actual contents of the file aren't checked. This means that it's possible to e.g. upload an executable file renamed to be a .jpg. This file could then be executed by another security vulnerability. This vulnerability is fixed in 9.13.2.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code CVE-2022-47053 · Other software · Dnnsoftware · reported by MITREMedium 5.4
An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file.
- Product
- Dotnetnuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddnnsoftware.comdnnsoftware.com
Jul 20, 2022DotNetNuke (DNN) 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated CVE-2021-31858 · Other software · Dnnsoftware · reported by MITREMedium 5.4
DotNetNuke (DNN) 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated users to inject arbitrary code via a crafted payload.
- Product
- Dotnetnuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.integrity.ptdnnsoftware.com
Jun 2, 2022The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke.CVE-2021-40186 · Other software · DNNSoftware · reported by info@appcheck-ng.comMedium 6.5
The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulnerabilities allow the attacker to exploit the target system to make network requests on their behalf, allowing a range of possible attacks. In the most common scenario, the attacker exploits SSRF vulnerabilities to attack systems behind the firewall and access sensitive information from Cloud Provider metadata services.
- Product
- DNN Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordappcheck-ng.comappcheck-ng.com
Apr 6, 2020There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module.CVE-2020-11585 · Other software · Dnnsoftware · reported by MITREMedium 4.3
There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter.
- Product
- Dotnetnuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2020DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.CVE-2020-5188 · Other software · Dnnsoftware · reported by MITREMedium 6.5
DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.
- Product
- Dotnetnuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 24, 2020DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).CVE-2020-5187 · Other software · Dnnsoftware · reported by MITREHigh 8.8
DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).
- Product
- Dotnetnuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 24, 2020DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).CVE-2020-5186 · Other software · Dnnsoftware · reported by MITREMedium 5.4
DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).
- Product
- Dotnetnuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2020The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator priviCVE-2019-19392 · Other software · Fordnn · reported by MITRECritical 9.8
The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data.
- Product
- Usersexportimport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.joaoorvalho.comgithub.com
Sep 26, 2019Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notificationCVE-2019-12562 · Other software · Dnnsoftware · reported by MITREMedium 6.1
Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to the server, etc. Successful exploitation occurs when an admin user visits a notification page with stored cross-site scripting.
- Product
- Dotnetnuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.commayaseven.com
Jul 3, 2019DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy.CVE-2018-18326 · Other software · Dnnsoftware · reported by MITREHigh 7.5
DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.
- Product
- Dotnetnuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 3, 2019DotNetNuke (DNN) Inadequate Encryption Strength VulnerabilityCVE-2018-18325 · Other software · DotNetNuke (DNN) · reported by MITREExploitedHigh 7.5
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811.
- Product
- DotNetNuke (DNN)
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install DotNetNuke (DNN)’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comgithub.com
Jul 3, 2019DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.CVE-2018-15812 · Other software · Dnnsoftware · reported by MITREHigh 7.5
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
- Product
- Dotnetnuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 3, 2019DotNetNuke (DNN) Inadequate Encryption Strength VulnerabilityCVE-2018-15811 · Other software · DotNetNuke (DNN) · reported by MITREExploitedHigh 7.5
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters.
- Product
- DotNetNuke (DNN)
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install DotNetNuke (DNN)’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comgithub.com
Mar 21, 2019DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.CVE-2018-14486 · Other software · Dnnsoftware · reported by MITREMedium 6.1
DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.
- Product
- Dotnetnuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdnnsoftware.com
Jul 3, 2018DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class.CVE-2017-0929 · Other software · Dnnsoftware · reported by support@hackerone.comHigh 7.5
DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.
- Product
- Dotnetnuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2018The CATALooK.netStore module through 7.2.8 for DNN (formerly DotNetNuke) allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImagCVE-2018-10138 · Other software · Catalooksupport · reported by MITREMedium 6.1
The CATALooK.netStore module through 7.2.8 for DNN (formerly DotNetNuke) allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImageViewer.aspx link or desc parameter.
- Product
- .netstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comcxsecurity.com
Apr 4, 2018The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via CVE-2018-9126 · Other software · Zldnn · reported by MITRECritical 9.8
The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI.
- Product
- Dnnarticle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jul 20, 2017DotNetNuke (DNN) Remote Code Execution VulnerabilityCVE-2017-9822 · Other software · DotNetNuke (DNN) · reported by security-alert@hpe.comExploitedRansomwareHigh 8.8
DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.
- Product
- DotNetNuke (DNN)
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install DotNetNuke (DNN)’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comdnnsoftware.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.