Dnnsoftware / Dotnetnuke
76 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-40321 | DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload | HIGH | 8.1 | Apr 17, 2026 |
| CVE-2026-40306 | DNN has same HostGUID for all new installs | MEDIUM | 6.9 | Apr 17, 2026 |
| CVE-2026-40305 | DNN has Force Friend Request Acceptance | MEDIUM | 4.3 | Apr 17, 2026 |
| CVE-2020-37103 | DotNetNuke 9.5 - Persistent Cross-Site Scripting | MEDIUM | 5.1 | Feb 3, 2026 |
| CVE-2026-24838 | DotNetNuke.Core Vulnerable to Stored XSS via Module Title | CRITICAL | 9.1 | Jan 27, 2026 |
| CVE-2026-24837 | DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal | HIGH | 7.7 | Jan 27, 2026 |
| CVE-2026-24836 | DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes | HIGH | 7.7 | Jan 27, 2026 |
| CVE-2026-24833 | DotNetNuke.Core Vulnerable to Stored XSS in Module Description | HIGH | 7.7 | Jan 27, 2026 |
| CVE-2026-24784 | DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer | MEDIUM | 6.9 | Jan 27, 2026 |
| CVE-2025-64095 | DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite | CRITICAL | 10.0 | Oct 28, 2025 |
| CVE-2025-64094 | DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload | MEDIUM | 6.4 | Oct 28, 2025 |
| CVE-2025-62802 | DNN CKEditor Provider allows unauthenticated upload out-of-the-box | MEDIUM | 4.3 | Oct 28, 2025 |
| CVE-2025-59548 | DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser | MEDIUM | 5.9 | Sep 23, 2025 |
| CVE-2025-59547 | DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation | MEDIUM | 5.3 | Sep 23, 2025 |
| CVE-2025-59821 | DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile | MEDIUM | 6.5 | Sep 23, 2025 |
| CVE-2025-59546 | DNN Vulnerable to Stored XSS Using Backend Admin Credentials | MEDIUM | 4.8 | Sep 23, 2025 |
| CVE-2025-59545 | DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module | CRITICAL | 9.1 | Sep 23, 2025 |
| CVE-2025-59539 | DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field | MEDIUM | 6.3 | Sep 23, 2025 |
| CVE-2025-59535 | DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters | MEDIUM | 6.5 | Sep 22, 2025 |
| CVE-2025-52488 | DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input | HIGH | 8.6 | Jun 21, 2025 |
| CVE-2025-52487 | DNN.PLATFORM possibly allows bypass of IP Filters | HIGH | 8.8 | Jun 21, 2025 |
| CVE-2025-52486 | DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects | MEDIUM | 6.1 | Jun 21, 2025 |
| CVE-2025-52485 | DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed | MEDIUM | 5.1 | Jun 21, 2025 |
| CVE-2025-48377 | Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode | MEDIUM | 6.0 | May 23, 2025 |
| CVE-2025-48378 | Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline | MEDIUM | 6.1 | May 23, 2025 |
Showing 1 to 25 of 76 CVEs