Skip to main content
cve.nowby Sazabi
← NuGet
NuGetPackage

DotNetNuke.Core

35 known vulnerabilities (2 critical, 6 high, 11 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
10.4.1 (Oct 28, 2026): no advisory affects it
Newest unaffected release
10.4.1 (Oct 28, 2026), the latest release
Advisories
35 · 2 critical, 6 high, 11 medium, 1 low
Releases
83 since 6.0.0 (Jun 13, 2013)
Registry
NuGet
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-40321
    Affects 6.0.0 to 10.2.1 (10.2.2 is outside it)
  • CVE-2026-40306
    Affects 10.0.0 to 10.2.1 (10.2.2 is outside it)
  • CVE-2026-40305
    Affects 6.0.0 to 10.2.1 (10.2.2 is outside it)
  • CVE-2026-24838
    Affects 6.0.0 to 9.13.9 (10.0.0-rc.2 is outside it); 10.0.0 to 10.1.2 (10.2.0 is outside it)
  • CVE-2026-24837
    Affects 9.0.0.1002 to 9.13.9 (10.0.0-rc.2 is outside it); 10.0.0 to 10.1.2 (10.2.0 is outside it)
  • CVE-2026-24836
    Affects 9.0.0.1002 to 9.13.9 (10.0.0-rc.2 is outside it); 10.0.0 to 10.1.2 (10.2.0 is outside it)
  • CVE-2026-24784
    Affects 9.0.0.1002 to 9.13.9 (10.0.0-rc.2 is outside it); 10.0.0 to 10.1.2 (10.2.0 is outside it)
  • CVE-2025-64094
    Affects 6.0.0 to 10.1.0 (10.1.1 is outside it)
  • CVE-2025-59821
    Affects 6.0.0 to 10.0.1 (10.1.0 is outside it)
  • CVE-2025-59546
    Affects 6.0.0 to 10.0.1 (10.1.0 is outside it)
  • CVE-2025-59545
    Affects 6.0.0 to 10.0.1 (10.1.0 is outside it)
  • CVE-2025-59539
    Affects 6.0.0 to 10.0.1 (10.1.0 is outside it)
Show all 35 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 35

  • DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload

    Affected: fixed in 10.2.2.

    Fixed in 10.2.2 (released Feb 21, 2026, 55 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • CVE-2026-40306Medium 6.9

    DNN has same HostGUID for all new installs

    Affected: from 10.0.0, fixed in 10.2.2.

    Fixed in 10.2.2 (released Feb 21, 2026, 55 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • CVE-2026-40305Medium 4.3

    DNN has Force Friend Request Acceptance

    Affected: from 6.0.0, fixed in 10.2.2.

    Fixed in 10.2.2 (released Feb 21, 2026, 55 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • CVE-2026-24838Critical 9.1

    DotNetNuke.Core Vulnerable to Stored XSS via Module Title

    Affected: fixed in 9.13.10; from 10.0.0, fixed in 10.2.0.

    Fixed in 10.2.0 (released Dec 17, 2025, 41 days before disclosure, the advisory names 9.13.10, which was never published).

    The latest release, 10.4.1, is not affected.

  • DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

    Affected: from 9.0.0, through 9.13.9; from 10.0.0, fixed in 10.2.0.

    Fixed in 10.2.0 (released Dec 17, 2025, 41 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

    Affected: from 9.0.0, through 9.13.9; from 10.0.0, fixed in 10.02.0.

    Fixed in 10.2.0 (released Dec 17, 2025, 41 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • CVE-2026-24784Medium 6.8

    DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer

    Affected: from 9.0.0, fixed in 9.13.10; from 10.0.0, fixed in 10.2.0.

    Fixed in 10.2.0 (released Dec 17, 2025, 41 days before disclosure, the advisory names 9.13.10, which was never published).

    The latest release, 10.4.1, is not affected.

  • CVE-2025-64094Medium 6.4

    DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

    Affected: fixed in 10.1.1.

    Fixed in 10.1.1 (released Sep 30, 2025, 28 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • CVE-2025-59821Medium 6.5

    DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile

    Affected: fixed in 10.1.0.

    Fixed in 10.1.0 (released Aug 21, 2025, 33 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • DNN Vulnerable to Stored XSS Using Backend Admin Credentials

    Affected: fixed in 10.1.0.

    Fixed in 10.1.0 (released Aug 21, 2025, 33 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • CVE-2025-59545Critical 9.1

    DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module

    Affected: fixed in 10.1.0.

    Fixed in 10.1.0 (released Aug 21, 2025, 33 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • CVE-2025-59539Medium 6.3

    DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

    Affected: fixed in 10.1.0.

    Fixed in 10.1.0 (released Aug 21, 2025, 33 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • CVE-2025-59535Medium 6.5

    DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters

    Affected: fixed in 10.1.0.

    Fixed in 10.1.0 (released Aug 21, 2025, 32 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • CVE-2025-48377Medium 6.0

    Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode

    Affected: fixed in 9.13.9.

    Fixed in 9.13.9 (released Apr 22, 2025, 31 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • CVE-2025-48378Medium 6.1

    Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline

    Affected: fixed in 9.13.9.

    Fixed in 9.13.9 (released Apr 22, 2025, 31 days before disclosure).

    The latest release, 10.4.1, is not affected.

Show all 35 advisoriesShow fewer advisories
  • CVE-2025-32372Medium 6.5

    Server-Side Request Forgery (SSRF) in DotNetNuke.Core

    Affected: fixed in 9.13.8.

    Fixed in 9.13.8 (released Mar 5, 2025, 35 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • CVE-2022-2922Medium 4.9

    Relative Path Traversal in dnnsoftware/dnn.platform

    Affected: fixed in 9.11.0.

    Fixed in 9.11.0 (released Sep 28, 2022, 2 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).

    Affected: through 9.4.4.

    Fixed in 9.5.0 (released Mar 5, 2020, 10 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 10.4.1, is not affected.

  • DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).

    Affected: fixed in 9.5.0.

    Fixed in 9.5.0 (released Mar 5, 2020, 10 days after disclosure).

    The latest release, 10.4.1, is not affected.

  • DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.

    Affected: through 9.4.4.

    Fixed in 9.5.0 (released Mar 5, 2020, 10 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 10.4.1, is not affected.

  • Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into…

    Affected: fixed in 9.4.0.

    Fixed in 9.4.0 (released Sep 12, 2019, 14 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy.

    Affected: fixed in 9.3.0.

    Fixed in 9.3.0 (released Mar 20, 2019, 105 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • CVE-2018-18325High 7.5 · KEV

    DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters.

    Affected: fixed in 9.3.0.

    Fixed in 9.3.0 (released Mar 20, 2019, 105 days before disclosure).

    The latest release, 10.4.1, is not affected.

  • DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.

    Affected: from 9.2.0, fixed in 9.2.2.

    Fixed in 9.3.0 (released Mar 20, 2019, 105 days before disclosure, the advisory names 9.2.2, which was never published).

    The latest release, 10.4.1, is not affected.

  • CVE-2018-15811High 7.5 · KEV

    DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

    Affected: from 9.2.0, fixed in 9.2.2.

    Fixed in 9.3.0 (released Mar 20, 2019, 105 days before disclosure, the advisory names 9.2.2, which was never published).

    The latest release, 10.4.1, is not affected.

  • DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.

    Affected: through 9.1.1.

    Fixed in 9.1.1.129 (released Jul 5, 2017, 620 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 10.4.1, is not affected.

  • DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class.

    Affected: fixed in 9.2.0.

    Fixed in 9.2.0.366 (released May 1, 2018, 63 days before disclosure, the advisory names 9.2.0, which was never published).

    The latest release, 10.4.1, is not affected.

  • CVE-2017-9822High 8.8 · KEV

    DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN site

    Affected: fixed in 9.1.1.

    Fixed in 9.1.1.129 (released Jul 5, 2017, 15 days before disclosure, the advisory names 9.1.1, which was never published).

    The latest release, 10.4.1, is not affected.

  • The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access…

    Affected: fixed in 7.4.1.

    Fixed in 7.4.1.280 (released Jun 10, 2015, 607 days before disclosure, the advisory names 7.4.1, which was never published).

    The latest release, 10.4.1, is not affected.

  • Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote…

    Affected: fixed in 8.0.1.

    Fixed in 8.0.1.239 (released Jul 4, 2016, 58 days before disclosure, the advisory names 8.0.1, which was never published).

    The latest release, 10.4.1, is not affected.

  • Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML…

    Affected: fixed in 7.4.0.

    Fixed in 7.4.0.353 (released Feb 3, 2015, 6 days before disclosure, the advisory names 7.4.0, which was never published).

    The latest release, 10.4.1, is not affected.

  • Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary…

    Affected: fixed in 6.2.9; from 7.0, fixed in 7.1.1.

    Fixed in 7.1.2 (released Oct 16, 2013, 147 days before disclosure, the advisory names 6.2.9, which was never published).

    The latest release, 10.4.1, is not affected.

  • Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary…

    Affected: fixed in 6.2.9; from 7.0, fixed in 7.1.1.

    Fixed in 7.1.2 (released Oct 16, 2013, 147 days before disclosure, the advisory names 6.2.9, which was never published).

    The latest release, 10.4.1, is not affected.

  • DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2)…

    Affected: fixed in 4.8.2.

    Fixed in 6.0.0 (released Jun 13, 2013, 1536 days after disclosure, the advisory names 4.8.2, which was never published).

    The latest release, 10.4.1, is not affected.

  • Cross-site scripting (XSS) vulnerability in the IFrame module before 03.02.01 for DotNetNuke (DNN) allows remote attackers to inject…

    Affected: fixed in 03.02.01.

    Fixed in 6.0.0 (released Jun 13, 2013, 2324 days after disclosure, the advisory names 03.02.01, which was never published).

    The latest release, 10.4.1, is not affected.