Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
32 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The codebase raises code analysis warnings related to security, including CA3075, CA5366, CA5371, CA5368, CA5369, CA5372, CA5379, CA5350, and CA5351. Most of these deal with disabling DTD processing in XML documents, but also includes cryptographic algorithm choices.
Recommended action: Upgrade to 10.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have the same Host GUID. This does not affect upgrades from 9.x.x. Version 10.2.2 patches the issue.
Recommended action: Upgrade to 10.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2 patches the issue.
Recommended action: Upgrade to 10.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.
Recommended action: Upgrade to 10.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Module title supports richtext which could include scripts that would execute in certain scenarios.
Recommended action: Upgrade to 10.2.0 or 9.13.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A module friendly name could include scripts that will run during some module operations in the Persona Bar.
Recommended action: Upgrade to 10.2.0; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A content editor could inject scripts in module headers/footers that would run for other users.
Recommended action: Upgrade to 10.2.0 or 9.13.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios. Details DNN validates the contents of SVG's to ensure they are valid and do not contain any malicious code. These checks were introduced as part of CVE-2025-48378. However, the checks to ensure there are no script elements within the SVG files are not comprehensive and may allow some malicious SVG files to be uploaded. As this vulnerability allows for the execution of arbitrary JavaScript code within the context of the user's browser, it can lead to a range of attacks, including data exfiltration, session hijacking, and defacement of the web application to name a few.
Recommended action: Upgrade to 10.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A reflected cross-site scripting (XSS) vulnerability exists under certain conditions, using a specially crafter url to view a user profile Description DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that are returned to the browser. In these cases, the application does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim’s browser to interpret attacker-controlled content as part of the page’s HTML.
Recommended action: Upgrade to 10.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Users that can edit modules could set a title that includes scripts. Description Some users (administrators and content editors) can set html in module titles and that could include javascript which could be used for XSS based attacks. With the addition of more roles being able to set module titles, this is not strictly limited to administrators. However since HTML in module titles could be a valid use case, we have added a setting for this functionality in the Security module in the Persona Bar.
Recommended action: Upgrade to 10.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution (XSS). Description The application sanitizes most user-submitted data before displaying it in entry forms. However, the Prompt module is capable of running commands whose output is treated as HTML. This creates a vulnerability where a malicious user can craft input containing embedded scripts or harmful markup. If such malicious content is later processed by a Prompt command and returned as HTML, it bypasses the standard sanitation mechanisms. Simply executing a specific command through the Prompt module could render this untrusted data and cause unintended script execution in the browser specially in the context of a super-user.
Recommended action: Upgrade to 10.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Users can use special syntax to inject javascript code in their profile biography field. Although there was sanitization in place, it did not cover all possible scenarios Description When embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers.
Recommended action: Upgrade to 10.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. Details Many people who run DNN sites have a number of installed themes that they do not actually use. This could be because they were testing many themes during initial setup, because they have changed themes over time, or because they have development and production versions of a theme. Whatever the reason, many times the unused themes will become outdated over time as site admins wouldn't have reason to update something that is not used. However, this could introduce an entry point to exploit a vulnerable theme by making the server run the unused theme for unsuspecting client requests. Depending on the vulnerability in a theme, this could lead to server side or client side arbitrary code execution. With DNN 10.1.0 this functionality is now disabled by…
Recommended action: Upgrade to 10.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks.
Recommended action: Upgrade to 9.13.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions.
Recommended action: Upgrade to 9.13.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. Impact This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls.
Recommended action: Upgrade to 9.13.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DNN (GitHub repository dnnsoftware/dnn.platform) prior to 9.11.0 is vulnerable to Relative Path Traversal. Version 9.11.0 contains a patch for this issue.
Recommended action: Upgrade to 9.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal via unsafe handling of zip files
Recommended action: Upgrade to 9.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Recommended action: Upgrade to 7.1.1 or 6.2.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the dnnVariable parameter to the default URI.
Recommended action: Upgrade to 7.1.1 or 6.2.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys.
Recommended action: Upgrade to 4.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the IFrame module before 03.02.01 for DotNetNuke (DNN), caused by improper validation of user-supplied input by an unspecified script. Pass through values were not getting filtered, leaving them vulnerable to XSS. A remote attacker could exploit this vulnerability using various parameters in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Recommended action: Upgrade to 03.02.01 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) is possible in DNN (formerly DotNetNuke) before 9.4.0 by remote authenticated users via the Display Name field in the admin notification function.
Recommended action: Upgrade to 9.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
Recommended action: Upgrade to 9.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
Recommended action: Upgrade to 9.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.