NuGet Package Vulnerabilities

Open in search

Vulnerabilities associated with DotNetNuke.Core.

Packages

Clear package

Showing 25 vulnerabilities on this page for DotNetNuke.Core

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.

CWE-87Apr 17, 2026
CVSS8.1v3.1EPSS7.6%PoCs0SignalsSTIX

DNN has same HostGUID for all new installs

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have the same Host GUID. This does not affect upgrades from 9.x.x. Version 10.2.2 patches the issue.

CWE-330Apr 17, 2026
CVSS6.9v4.0EPSS0.175%PoCs0SignalsSTIX

DNN has Force Friend Request Acceptance

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2 patches the issue.

CWE-285Apr 17, 2026
CVSS4.3v3.1EPSS0.183%PoCs0SignalsSTIX

DotNetNuke.Core security code analysis rules triggered

The codebase raises code analysis warnings related to security, including CA3075, CA5366, CA5371, CA5368, CA5369, CA5372, CA5379, CA5350, and CA5351. Most of these deal with disabling DTD processing in XML documents, but also includes cryptographic algorithm choices.

Apr 14, 2026
CVSS-EPSS-PoCs0SignalsSTIX

DotNetNuke.Core Vulnerable to Stored XSS via Module Title

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

CWE-79Jan 27, 2026
CVSS9.1v3.1EPSS0.188%PoCs0SignalsSTIX

DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a module friendly name could include scripts that will run during some module operations in the Persona Bar. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

CWE-79Jan 27, 2026
CVSS7.7v3.1EPSS0.249%PoCs0SignalsSTIX

DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

CWE-79Jan 27, 2026
CVSS7.7v3.1EPSS0.226%PoCs0SignalsSTIX

DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a content editor could inject scripts in module headers/footers that would run for other users. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

CWE-79Jan 27, 2026
CVSS6.8v3.1EPSS0.16%PoCs0SignalsSTIX

DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios. This vulnerability exists because of an incomplete fix for CVE-2025-48378. This vulnerability is fixed in 10.1.1.

CWE-79Oct 28, 2025
CVSS6.4v3.1EPSS0.183%PoCs0SignalsSTIX

DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. In these cases, the application does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim’s browser to interpret attacker-controlled content as part of the …

CWE-79Sep 23, 2025
CVSS6.5v3.1EPSS0.196%PoCs0SignalsSTIX

DNN Vulnerable to Stored XSS Using Backend Admin Credentials

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, administrators and content editors can set html in module titles that could include javascript which could be used for XSS based attacks. This issue has been patched in version 10.1.0.

CWE-79Sep 23, 2025
CVSS2.4v3.1EPSS0.171%PoCs0SignalsSTIX

DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution (XSS). This issue has been patched in version 10.1.0.

CWE-79Sep 23, 2025
CVSS9.1v3.1EPSS0.506%PoCs0SignalsSTIX

DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0.

CWE-79Sep 23, 2025
CVSS6.3v3.1EPSS0.166%PoCs0SignalsSTIX

DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.

CWE-20CWE-200CWE-829Sep 22, 2025
CVSS6.5v3.1EPSS0.322%PoCs0SignalsSTIX

Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions. Version 9.13.9 fixes the issue.

CWE-79May 23, 2025
CVSS6.0v4.0EPSS0.21%PoCs0SignalsSTIX

Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.

CWE-79May 23, 2025
CVSS6.1v4.0EPSS0.259%PoCs0SignalsSTIX

Server-Side Request Forgery (SSRF) in DotNetNuke.Core

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full res…

CWE-918Apr 9, 2025
CVSS6.5v3.1EPSS0.36%PoCs0SignalsSTIX

Relative Path Traversal in dnnsoftware/dnn.platform

Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.

CWE-22CWE-23Sep 30, 2022
CVSS4.9v3.1EPSS1.07%PoCs0SignalsSTIX

DNN XSS Vulnerability

DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).

CWE-79Feb 24, 2020
CVSS5.4v3.1EPSS0.889%PoCs0SignalsSTIX

DNN Path Traversal via Zip Slip

DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).

CWE-22Feb 24, 2020
CVSS8.8v3.1EPSS2.41%PoCs0SignalsSTIX

DNN File Upload Vulnerability

DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.

CWE-434CWE-669Feb 24, 2020
CVSS6.5v3.1EPSS1.82%PoCs0SignalsSTIX

Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke

Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to the server, etc. Successful exploitation occurs when an admin user visits a notification page with stored cross-site scripting.

CWE-79Sep 26, 2019
CVSS6.1v3.1EPSS6.18%PoCs2SignalsSTIX

Insufficient Entropy in DotNetNuke

DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.

CWE-331Jul 3, 2019
CVSS7.5v3.1EPSS53.6%PoCs2SignalsSTIX

Inadequate Encryption Strength in DotNetNuke

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

CWE-326Jul 3, 20191 related artifact
CVSS7.5v3.1EPSS74%PoCs2SignalsSTIX

Insufficient Entropy in DotNetNuke

DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.

CWE-331Jul 3, 2019
CVSS7.5v3.1EPSS46.5%PoCs2SignalsSTIX