CVE-2013-4649

DotNetNuke < 6.2.9 and 7.x < 7.1.1 - Cross-Site Scripting via __dnnVariable Parameter

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.

References (4)

Core 4
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/53493
Patch, Vendor Advisory x_refsource_confirm
http://www.dnnsoftware.com/platform/manage/security-center
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/86432

Scores

EPSS 0.0027
EPSS Percentile 50.4%

Details

CWE
CWE-79
Status published
Products (50)
dnnsoftware/dotnetnuke 1.0.6
dnnsoftware/dotnetnuke 1.0.7
dnnsoftware/dotnetnuke 1.0.8
dnnsoftware/dotnetnuke 1.0.9
dnnsoftware/dotnetnuke 1.0.10d
dnnsoftware/dotnetnuke 1.0.10e
dnnsoftware/dotnetnuke 2.1.1
dnnsoftware/dotnetnuke 2.1.2
dnnsoftware/dotnetnuke 3.0.7
dnnsoftware/dotnetnuke 3.0.8
... and 40 more
Published Mar 12, 2014
Tracked Since Feb 18, 2026