Vulnerability · Published Sep 23, 2025 · Assigned by GitHub_M
CVE-2025-59821DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile
Medium 6.5
In plain English
A medium-severity cross-site scripting in Dnn.Platform from dnnsoftware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. In these cases, the application does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim’s browser to interpret attacker-controlled content as part of the page’s HTML. This issue has been patched in version 10.1.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | dotnetnuke.core | 10.1.0 | GHSA-jc4g-c8ww-5738 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dnnsoftware | Dnn.Platform | < 10.1.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N