CVE-2025-52485: DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue has been patched in version 10.0.1.
Other sources
DNN.PLATFORM allows a specially crafted request can inject scripts in the Activity Feed Attachments endpoint which will then render in the feed, resulting in a cross-site scripting attack. This vulnerability is fixed in 10.0.1.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52485?
The severity of CVE-2025-52485 is considered high due to its potential for remote code execution through script injection.
How do I fix CVE-2025-52485?
To fix CVE-2025-52485, upgrade DNN.PLATFORM to version 10.0.1 or later.
What versions are affected by CVE-2025-52485?
CVE-2025-52485 affects DNN.PLATFORM versions from 6.0.0 to before 10.0.1.
What types of attacks are possible due to CVE-2025-52485?
CVE-2025-52485 allows attackers to inject malicious scripts that could execute in users' browsers.
Is there a workaround for CVE-2025-52485 if I cannot upgrade immediately?
A recommended workaround for CVE-2025-52485 is to restrict access to the Activity Feed Attachments endpoint while planning for the upgrade.