# cve.now: Dnnsoftware

The newest entries naming Dnnsoftware as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-40321](https://cve.now/CVE-2026-40321.md): DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload (CVSS 8.1)
- [CVE-2026-40306](https://cve.now/CVE-2026-40306.md): DNN has same HostGUID for all new installs (CVSS 6.9)
- [CVE-2026-40305](https://cve.now/CVE-2026-40305.md): DNN has Force Friend Request Acceptance (CVSS 4.3)
- [CVE-2020-37103](https://cve.now/CVE-2020-37103.md): DotNetNuke 9.5 - Persistent Cross-Site Scripting (CVSS 5.1)
- [CVE-2026-24838](https://cve.now/CVE-2026-24838.md): DotNetNuke.Core Vulnerable to Stored XSS via Module Title (CVSS 9.1)
- [CVE-2026-24837](https://cve.now/CVE-2026-24837.md): DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal (CVSS 7.7)
- [CVE-2026-24836](https://cve.now/CVE-2026-24836.md): DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes (CVSS 7.7)
- [CVE-2026-24833](https://cve.now/CVE-2026-24833.md): DotNetNuke.Core Vulnerable to Stored XSS in Module Description (CVSS 7.7)
- [CVE-2026-24784](https://cve.now/CVE-2026-24784.md): DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer (CVSS 6.8)
- [CVE-2025-64095](https://cve.now/CVE-2025-64095.md): DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite (CVSS 10.0)
- [CVE-2025-64094](https://cve.now/CVE-2025-64094.md): DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload (CVSS 6.4)
- [CVE-2025-62802](https://cve.now/CVE-2025-62802.md): DNN CKEditor Provider allows unauthenticated upload out-of-the-box (CVSS 4.3)
- [CVE-2025-59548](https://cve.now/CVE-2025-59548.md): DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser (CVSS 5.9)
- [CVE-2025-59547](https://cve.now/CVE-2025-59547.md): DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation (CVSS 5.3)
- [CVE-2025-59821](https://cve.now/CVE-2025-59821.md): DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile (CVSS 6.5)
- [CVE-2025-59546](https://cve.now/CVE-2025-59546.md): DNN Vulnerable to Stored XSS Using Backend Admin Credentials (CVSS 2.4)
- [CVE-2025-59545](https://cve.now/CVE-2025-59545.md): DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module (CVSS 9.1)
- [CVE-2025-59539](https://cve.now/CVE-2025-59539.md): DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field (CVSS 6.3)
- [CVE-2025-59535](https://cve.now/CVE-2025-59535.md): DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters (CVSS 6.5)
- [CVE-2025-52488](https://cve.now/CVE-2025-52488.md): DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input (CVSS 8.6)
- [CVE-2025-52487](https://cve.now/CVE-2025-52487.md): DNN.PLATFORM possibly allows bypass of IP Filters (CVSS 8.8)
- [CVE-2025-52486](https://cve.now/CVE-2025-52486.md): DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects (CVSS 6.1)
- [CVE-2025-52485](https://cve.now/CVE-2025-52485.md): DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed (CVSS 5.1)
- [CVE-2025-48377](https://cve.now/CVE-2025-48377.md): Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode (CVSS 6.0)
- [CVE-2025-48378](https://cve.now/CVE-2025-48378.md): Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline (CVSS 6.1)
- [CVE-2025-48376](https://cve.now/CVE-2025-48376.md): Dnn.Platform's Site Import could use an external source with a crafted request (CVSS 3.5)
- [CVE-2025-32374](https://cve.now/CVE-2025-32374.md): Possible Denial of Service (DoS) in DNN.PLATFORM registration (CVSS 5.9)
- [CVE-2025-32373](https://cve.now/CVE-2025-32373.md): DNN allows a registered user to enumerate and access files they should not have access to (CVSS 6.5)
- [CVE-2025-32372](https://cve.now/CVE-2025-32372.md): Server-Side Request Forgery (SSRF) in DotNetNuke.Core (CVSS 6.5)
- [CVE-2025-32371](https://cve.now/CVE-2025-32371.md): Unexpected external content may be displayed in DNN ImageHandler (CVSS 4.3)
- [CVE-2025-32036](https://cve.now/CVE-2025-32036.md): DNN allows the possibility of bypassing Captcha (CVSS 4.2)
- [CVE-2025-32035](https://cve.now/CVE-2025-32035.md): DNN does not check the contents of a file when uploading files (CVSS 2.6)
- [CVE-2022-2922](https://cve.now/CVE-2022-2922.md): Relative Path Traversal in dnnsoftware/dnn.platform (CVSS 4.9)
- [CVE-2021-40186](https://cve.now/CVE-2021-40186.md): DNN CMS Server-Side Request Forgery (SSRF) (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/dnnsoftware
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.