# DotNetNuke.Core (NuGet) vulnerabilities 35 known vulnerabilities (2 critical, 6 high, 11 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 10.4.1 (Oct 28, 2026): no advisory affects it - Newest unaffected release: 10.4.1 (Oct 28, 2026), the latest release - Releases: 83 since 6.0.0 (Jun 13, 2013) - Registry: https://www.nuget.org/packages/DotNetNuke.Core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-40321: 6.0.0 to 10.2.1 (10.2.2 is outside it) - CVE-2026-40306: 10.0.0 to 10.2.1 (10.2.2 is outside it) - CVE-2026-40305: 6.0.0 to 10.2.1 (10.2.2 is outside it) - CVE-2026-24838: 6.0.0 to 9.13.9 (10.0.0-rc.2 is outside it); 10.0.0 to 10.1.2 (10.2.0 is outside it) - CVE-2026-24837: 9.0.0.1002 to 9.13.9 (10.0.0-rc.2 is outside it); 10.0.0 to 10.1.2 (10.2.0 is outside it) - CVE-2026-24836: 9.0.0.1002 to 9.13.9 (10.0.0-rc.2 is outside it); 10.0.0 to 10.1.2 (10.2.0 is outside it) - CVE-2026-24784: 9.0.0.1002 to 9.13.9 (10.0.0-rc.2 is outside it); 10.0.0 to 10.1.2 (10.2.0 is outside it) - CVE-2025-64094: 6.0.0 to 10.1.0 (10.1.1 is outside it) - CVE-2025-59821: 6.0.0 to 10.0.1 (10.1.0 is outside it) - CVE-2025-59546: 6.0.0 to 10.0.1 (10.1.0 is outside it) - CVE-2025-59545: 6.0.0 to 10.0.1 (10.1.0 is outside it) - CVE-2025-59539: 6.0.0 to 10.0.1 (10.1.0 is outside it) - CVE-2025-59535: 6.0.0 to 10.0.1 (10.1.0 is outside it) - CVE-2025-48377: 6.0.0 to 9.13.8 (9.13.9 is outside it) - CVE-2025-48378: 6.0.0 to 9.13.8 (9.13.9 is outside it) - CVE-2025-32372: 6.0.0 to 9.13.7 (9.13.8 is outside it) - CVE-2022-2922: 6.0.0 to 9.10.2 (9.11.0 is outside it) - CVE-2020-5186: 6.0.0 to 9.4.4 (9.5.0 is outside it) - CVE-2020-5187: 6.0.0 to 9.4.4 (9.5.0 is outside it) - CVE-2020-5188: 6.0.0 to 9.4.4 (9.5.0 is outside it) - CVE-2019-12562: 6.0.0 to 9.3.2 (9.4.0 is outside it) - CVE-2018-18326: 6.0.0 to 9.2.1.533 (9.3.0 is outside it) - CVE-2018-18325: 6.0.0 to 9.2.1.533 (9.3.0 is outside it) - CVE-2018-15812: 9.2.0.366 to 9.2.1.533 (9.3.0 is outside it) - CVE-2018-15811: 9.2.0.366 to 9.2.1.533 (9.3.0 is outside it) - CVE-2018-14486: 6.0.0 to 9.1.0.367 (9.1.1.129 is outside it) - CVE-2017-0929: 6.0.0 to 9.1.1.129 (9.2.0.366 is outside it) - CVE-2017-9822: 6.0.0 to 9.1.0.367 (9.1.1.129 is outside it) - CVE-2015-2794: 6.0.0 to 7.4.0.353 (7.4.1.280 is outside it) - CVE-2016-7119: 6.0.0 to 8.0.0.809 (8.0.1.239 is outside it) - CVE-2015-1566: 6.0.0 to 7.3.1.20 (7.4.0.353 is outside it) - CVE-2013-7335: 6.0.0 to 7.1.0 (7.1.2 is outside it) - CVE-2013-4649: 6.0.0 to 7.1.0 (7.1.2 is outside it) - CVE-2008-6540: no published release is affected - CVE-2007-0660: no published release is affected ## Advisories (35) ### [CVE-2026-40321](https://cve.now/CVE-2026-40321): DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload - Severity: High 8.1 - Published: Apr 17, 2026 - Affected: fixed in 10.2.2. - Fixed in 10.2.2 (released Feb 21, 2026, 55 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2026-40306](https://cve.now/CVE-2026-40306): DNN has same HostGUID for all new installs - Severity: Medium 6.9 - Published: Apr 17, 2026 - Affected: from 10.0.0, fixed in 10.2.2. - Fixed in 10.2.2 (released Feb 21, 2026, 55 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2026-40305](https://cve.now/CVE-2026-40305): DNN has Force Friend Request Acceptance - Severity: Medium 4.3 - Published: Apr 17, 2026 - Affected: from 6.0.0, fixed in 10.2.2. - Fixed in 10.2.2 (released Feb 21, 2026, 55 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2026-24838](https://cve.now/CVE-2026-24838): DotNetNuke.Core Vulnerable to Stored XSS via Module Title - Severity: Critical 9.1 - Published: Jan 27, 2026 - Affected: fixed in 9.13.10; from 10.0.0, fixed in 10.2.0. - Fixed in 10.2.0 (released Dec 17, 2025, 41 days before disclosure, the advisory names 9.13.10, which was never published). - The latest release, 10.4.1, is not affected. ### [CVE-2026-24837](https://cve.now/CVE-2026-24837): DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal - Severity: High 7.7 - Published: Jan 27, 2026 - Affected: from 9.0.0, through 9.13.9; from 10.0.0, fixed in 10.2.0. - Fixed in 10.2.0 (released Dec 17, 2025, 41 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2026-24836](https://cve.now/CVE-2026-24836): DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes - Severity: High 7.7 - Published: Jan 27, 2026 - Affected: from 9.0.0, through 9.13.9; from 10.0.0, fixed in 10.02.0. - Fixed in 10.2.0 (released Dec 17, 2025, 41 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2026-24784](https://cve.now/CVE-2026-24784): DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer - Severity: Medium 6.8 - Published: Jan 27, 2026 - Affected: from 9.0.0, fixed in 9.13.10; from 10.0.0, fixed in 10.2.0. - Fixed in 10.2.0 (released Dec 17, 2025, 41 days before disclosure, the advisory names 9.13.10, which was never published). - The latest release, 10.4.1, is not affected. ### [CVE-2025-64094](https://cve.now/CVE-2025-64094): DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload - Severity: Medium 6.4 - Published: Oct 28, 2025 - Affected: fixed in 10.1.1. - Fixed in 10.1.1 (released Sep 30, 2025, 28 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2025-59821](https://cve.now/CVE-2025-59821): DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile - Severity: Medium 6.5 - Published: Sep 23, 2025 - Affected: fixed in 10.1.0. - Fixed in 10.1.0 (released Aug 21, 2025, 33 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2025-59546](https://cve.now/CVE-2025-59546): DNN Vulnerable to Stored XSS Using Backend Admin Credentials - Severity: Low 2.4 - Published: Sep 23, 2025 - Affected: fixed in 10.1.0. - Fixed in 10.1.0 (released Aug 21, 2025, 33 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2025-59545](https://cve.now/CVE-2025-59545): DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module - Severity: Critical 9.1 - Published: Sep 23, 2025 - Affected: fixed in 10.1.0. - Fixed in 10.1.0 (released Aug 21, 2025, 33 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2025-59539](https://cve.now/CVE-2025-59539): DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field - Severity: Medium 6.3 - Published: Sep 23, 2025 - Affected: fixed in 10.1.0. - Fixed in 10.1.0 (released Aug 21, 2025, 33 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2025-59535](https://cve.now/CVE-2025-59535): DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters - Severity: Medium 6.5 - Published: Sep 22, 2025 - Affected: fixed in 10.1.0. - Fixed in 10.1.0 (released Aug 21, 2025, 32 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2025-48377](https://cve.now/CVE-2025-48377): Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode - Severity: Medium 6.0 - Published: May 23, 2025 - Affected: fixed in 9.13.9. - Fixed in 9.13.9 (released Apr 22, 2025, 31 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2025-48378](https://cve.now/CVE-2025-48378): Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline - Severity: Medium 6.1 - Published: May 23, 2025 - Affected: fixed in 9.13.9. - Fixed in 9.13.9 (released Apr 22, 2025, 31 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2025-32372](https://cve.now/CVE-2025-32372): Server-Side Request Forgery (SSRF) in DotNetNuke.Core - Severity: Medium 6.5 - Published: Apr 9, 2025 - Affected: fixed in 9.13.8. - Fixed in 9.13.8 (released Mar 5, 2025, 35 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2022-2922](https://cve.now/CVE-2022-2922): Relative Path Traversal in dnnsoftware/dnn.platform - Severity: Medium 4.9 - Published: Sep 30, 2022 - Affected: fixed in 9.11.0. - Fixed in 9.11.0 (released Sep 28, 2022, 2 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2020-5186](https://cve.now/CVE-2020-5186): DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2). - Severity: Unrated - Published: Feb 24, 2020 - Affected: through 9.4.4. - Fixed in 9.5.0 (released Mar 5, 2020, 10 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 10.4.1, is not affected. ### [CVE-2020-5187](https://cve.now/CVE-2020-5187): DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2). - Severity: Unrated - Published: Feb 24, 2020 - Affected: fixed in 9.5.0. - Fixed in 9.5.0 (released Mar 5, 2020, 10 days after disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2020-5188](https://cve.now/CVE-2020-5188): DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions. - Severity: Unrated - Published: Feb 24, 2020 - Affected: through 9.4.4. - Fixed in 9.5.0 (released Mar 5, 2020, 10 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 10.4.1, is not affected. ### [CVE-2019-12562](https://cve.now/CVE-2019-12562): Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into… - Severity: Unrated - Published: Sep 26, 2019 - Affected: fixed in 9.4.0. - Fixed in 9.4.0 (released Sep 12, 2019, 14 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2018-18326](https://cve.now/CVE-2018-18326): DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. - Severity: Unrated - Published: Jul 3, 2019 - Affected: fixed in 9.3.0. - Fixed in 9.3.0 (released Mar 20, 2019, 105 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2018-18325](https://cve.now/CVE-2018-18325): DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. - Severity: High 7.5 · KEV - Published: Jul 3, 2019 - Affected: fixed in 9.3.0. - Fixed in 9.3.0 (released Mar 20, 2019, 105 days before disclosure). - The latest release, 10.4.1, is not affected. ### [CVE-2018-15812](https://cve.now/CVE-2018-15812): DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy. - Severity: Unrated - Published: Jul 3, 2019 - Affected: from 9.2.0, fixed in 9.2.2. - Fixed in 9.3.0 (released Mar 20, 2019, 105 days before disclosure, the advisory names 9.2.2, which was never published). - The latest release, 10.4.1, is not affected. ### [CVE-2018-15811](https://cve.now/CVE-2018-15811): DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters. - Severity: High 7.5 · KEV - Published: Jul 3, 2019 - Affected: from 9.2.0, fixed in 9.2.2. - Fixed in 9.3.0 (released Mar 20, 2019, 105 days before disclosure, the advisory names 9.2.2, which was never published). - The latest release, 10.4.1, is not affected. ### [CVE-2018-14486](https://cve.now/CVE-2018-14486): DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML. - Severity: Unrated - Published: Mar 17, 2019 - Affected: through 9.1.1. - Fixed in 9.1.1.129 (released Jul 5, 2017, 620 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 10.4.1, is not affected. ### [CVE-2017-0929](https://cve.now/CVE-2017-0929): DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. - Severity: Unrated - Published: Jul 3, 2018 - Affected: fixed in 9.2.0. - Fixed in 9.2.0.366 (released May 1, 2018, 63 days before disclosure, the advisory names 9.2.0, which was never published). - The latest release, 10.4.1, is not affected. ### [CVE-2017-9822](https://cve.now/CVE-2017-9822): DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN site - Severity: High 8.8 · KEV - Published: Jul 20, 2017 - Affected: fixed in 9.1.1. - Fixed in 9.1.1.129 (released Jul 5, 2017, 15 days before disclosure, the advisory names 9.1.1, which was never published). - The latest release, 10.4.1, is not affected. ### [CVE-2015-2794](https://cve.now/CVE-2015-2794): The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access… - Severity: Unrated - Published: Feb 6, 2017 - Affected: fixed in 7.4.1. - Fixed in 7.4.1.280 (released Jun 10, 2015, 607 days before disclosure, the advisory names 7.4.1, which was never published). - The latest release, 10.4.1, is not affected. ### [CVE-2016-7119](https://cve.now/CVE-2016-7119): Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote… - Severity: Unrated - Published: Aug 31, 2016 - Affected: fixed in 8.0.1. - Fixed in 8.0.1.239 (released Jul 4, 2016, 58 days before disclosure, the advisory names 8.0.1, which was never published). - The latest release, 10.4.1, is not affected. ### [CVE-2015-1566](https://cve.now/CVE-2015-1566): Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML… - Severity: Unrated - Published: Feb 9, 2015 - Affected: fixed in 7.4.0. - Fixed in 7.4.0.353 (released Feb 3, 2015, 6 days before disclosure, the advisory names 7.4.0, which was never published). - The latest release, 10.4.1, is not affected. ### [CVE-2013-7335](https://cve.now/CVE-2013-7335): Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary… - Severity: Unrated - Published: Mar 12, 2014 - Affected: fixed in 6.2.9; from 7.0, fixed in 7.1.1. - Fixed in 7.1.2 (released Oct 16, 2013, 147 days before disclosure, the advisory names 6.2.9, which was never published). - The latest release, 10.4.1, is not affected. ### [CVE-2013-4649](https://cve.now/CVE-2013-4649): Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary… - Severity: Unrated - Published: Mar 12, 2014 - Affected: fixed in 6.2.9; from 7.0, fixed in 7.1.1. - Fixed in 7.1.2 (released Oct 16, 2013, 147 days before disclosure, the advisory names 6.2.9, which was never published). - The latest release, 10.4.1, is not affected. ### [CVE-2008-6540](https://cve.now/CVE-2008-6540): DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2)… - Severity: Unrated - Published: Mar 30, 2009 - Affected: fixed in 4.8.2. - Fixed in 6.0.0 (released Jun 13, 2013, 1536 days after disclosure, the advisory names 4.8.2, which was never published). - The latest release, 10.4.1, is not affected. ### [CVE-2007-0660](https://cve.now/CVE-2007-0660): Cross-site scripting (XSS) vulnerability in the IFrame module before 03.02.01 for DotNetNuke (DNN) allows remote attackers to inject… - Severity: Unrated - Published: Feb 1, 2007 - Affected: fixed in 03.02.01. - Fixed in 6.0.0 (released Jun 13, 2013, 2324 days after disclosure, the advisory names 03.02.01, which was never published). - The latest release, 10.4.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/nuget/dotnetnuke.core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.