CVE-2025-59545: DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module
Summary The Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution (XSS).
Description The application sanitizes most user-submitted data before displaying it in entry forms. However, the Prompt module is capable of running commands whose output is treated as HTML. This creates a vulnerability where a malicious user can craft input containing embedded scripts or harmful markup.
If such malicious content is later processed by a Prompt command and returned as HTML, it bypasses the standard sanitation mechanisms. Simply executing a specific command through the Prompt module could render this untrusted data and cause unintended script execution in the browser specially in the context of a super-user.
Other sources
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution (XSS). This issue has been patched in version 10.1.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59545?
CVE-2025-59545 is considered a high severity vulnerability due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2025-59545?
To fix CVE-2025-59545, you should update the DotNetNuke.Core package to version 10.1.0 or later.
What causes CVE-2025-59545?
CVE-2025-59545 is caused by the Prompt module allowing execution of commands that can process malicious input leading to XSS.
Who is affected by CVE-2025-59545?
CVE-2025-59545 affects users of the DotNetNuke.Core package prior to version 10.1.0.
Can I exploit CVE-2025-59545?
Yes, CVE-2025-59545 can be exploited by submitting malicious input that is incorrectly sanitized, allowing script execution.