Where
-Infinity
0

Trending

Last week
Last month
Last year

DNN Dnn.PlatformDnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode

Risk 27
Severity
6
EPSS
0.05%
XSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

A specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions.

1 / 2
Source: GitHub
First published (updated )
CVE-2025-48377

DNN Dnn.PlatformDnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline

Risk 27
Severity
6.1
EPSS
0.05%
XSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.

1 / 2
Source: MITRE
First published (updated )
CVE-2025-48378

DNN Dnn.PlatformDnn.Platform's Site Import could use an external source with a crafted request

Risk 18
Severity
3.5
EPSS
0.03%
AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L

A malicious SuperUser (Host) could craft a request to use an external url for a site export to then be imported.

1 / 2
Source: GitHub
First published (updated )
CVE-2025-48376

DNN Dnn.PlatformPossible Denial of Service (DoS) in DNN.PLATFORM registration

Risk 31
Severity
7.5
EPSS
0.05%
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Possible denial of service with specially crafted information in the public registration form. This vulnerability is fixed in 9.13.8.

First published (updated )
CVE-2025-32374

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203