Dnnsoftware vulnerabilities
34 CVEs and advisories name Dnnsoftware as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-40321DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload
- CVE-2026-40306DNN has same HostGUID for all new installs
- CVE-2026-40305DNN has Force Friend Request Acceptance
- CVE-2020-37103DotNetNuke 9.5 - Persistent Cross-Site Scripting
- CVE-2026-24838DotNetNuke.Core Vulnerable to Stored XSS via Module Title
- CVE-2026-24837DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal
- CVE-2026-24836DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes
- CVE-2026-24833DotNetNuke.Core Vulnerable to Stored XSS in Module Description
- CVE-2026-24784DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer
- CVE-2025-64095DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
- CVE-2025-64094DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload
- CVE-2025-62802DNN CKEditor Provider allows unauthenticated upload out-of-the-box
- CVE-2025-59548DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser
- CVE-2025-59547DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation
- CVE-2025-59821DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile
- CVE-2025-59546DNN Vulnerable to Stored XSS Using Backend Admin Credentials
- CVE-2025-59545DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module
- CVE-2025-59539DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field
- CVE-2025-59535DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters
- CVE-2025-52488DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input
- CVE-2025-52487DNN.PLATFORM possibly allows bypass of IP Filters
- CVE-2025-52486DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects
- CVE-2025-52485DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed
- CVE-2025-48377Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode
- CVE-2025-48378Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline
- CVE-2025-48376Dnn.Platform's Site Import could use an external source with a crafted request
- CVE-2025-32374Possible Denial of Service (DoS) in DNN.PLATFORM registration
- CVE-2025-32373DNN allows a registered user to enumerate and access files they should not have access to
- CVE-2025-32372Server-Side Request Forgery (SSRF) in DotNetNuke.Core
- CVE-2025-32371Unexpected external content may be displayed in DNN ImageHandler