Vulnerability · Published Sep 22, 2025 · Assigned by GitHub_M

CVE-2025-59535DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters

Medium 6.5

In plain English

A medium-severity improper input validation in Dnn.Platform from dnnsoftware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 62.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	dotnetnuke.core	10.1.0	GHSA-wq2j-w9pm-7x2p

Affected products (as reported)

Vendor	Product	Versions
dnnsoftware	Dnn.Platform	< 10.1.0

Weakness: CWE-20, CWE-200, CWE-829 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-wq2j-w9pm-7x2p x_refsource_CONFIRM
https://github.com/dnnsoftware/Dnn.Platform/commit/72f30f69fd2214d77f6c2577dfcca495a24caf5c x_refsource_MISC
https://github.com/dnnsoftware/Dnn.Platform/blob/develop/DNN%20Platform/Library/UI/Skins/Skin.cs#L305 x_refsource_MISC