CVE-2025-59539: DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field
Summary Users can use special syntax to inject javascript code in their profile biography field. Although there was sanitization in place, it did not cover all possible scenarios
Description When embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers.
Other sources
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59539?
CVE-2025-59539 has been classified with a moderate severity level due to the potential for JavaScript injection.
How do I fix CVE-2025-59539?
To mitigate CVE-2025-59539, it is recommended to apply proper input validation and sanitization for the Biography field to prevent JavaScript injection.
Which versions are affected by CVE-2025-59539?
CVE-2025-59539 affects all versions of DotNetNuke Core up to and including 10.1.0 and the 10.1.0-rc1 release.
What type of vulnerability is CVE-2025-59539?
CVE-2025-59539 is a JavaScript injection vulnerability that allows users to execute arbitrary scripts through their profile biography.
Can I exploit CVE-2025-59539 without prior knowledge?
Yes, CVE-2025-59539 can be exploited by users with basic knowledge of JavaScript syntax to manipulate the Biography field.