CVE-2025-48378

MEDIUM

Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-48378 has a selected CVSS score of 6.1 (medium).

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 23, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Dnn.Platform

Browse dnnsoftware / Dnn.Platform
CVE List< 9.13.9affected

DotNetNuke.Core

Browse NuGet / DotNetNuke.Core
GitHub AdvisoryBefore 9.13.9 · Fixed in 9.13.9affected

References

4