DotNetNuke Official Vendor Homepageproduct
http://dnnsoftware.com/ CVE-2020-37103
MEDIUM
DotNetNuke 9.5 - Persistent Cross-Site Scripting
Record summary
CVE-2020-37103 has a selected CVSS score of 5.1 (medium); EIP currently links 1 catalogued exploit.
Description
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 6, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
DotNetNukeBrowse Dnnsoftware / DotNetNuke | CVE List | Through 9.5 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBDotNetNuke 9.5 - Persistent Cross-Site ScriptingExploitDB exploitby Sajjad PouraliNot analyzed1 file
References
5Vulnerability Analysis Blog PostTechnical description
https://medium.com/@SajjadPourali/dnn-dotnetnuke-cms-not-as-secure-as-you-think-e8516f789175 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2020-37103 ExploitDB-48124exploit
https://www.exploit-db.com/exploits/48124 VulnCheck Advisory: DotNetNuke 9.5 - Persistent Cross-Site ScriptingThird-party advisory
https://www.vulncheck.com/advisories/dotnetnuke-persistent-cross-site-scripting