DDNNSoftware

Products

Exploited and recent CVEs

• CVE-2026-40321 High 8.1 DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload 6.4%
• CVE-2026-40306 Medium 6.9 DNN has same HostGUID for all new installs 0.2%
• CVE-2026-40305 Medium 4.3 DNN has Force Friend Request Acceptance 0.2%
• CVE-2020-37103 Medium 6.4 DotNetNuke 9.5 - Persistent Cross-Site Scripting 0.4%
• CVE-2026-24838 Critical 9.1 DotNetNuke.Core Vulnerable to Stored XSS via Module Title 0.2%
• CVE-2026-24837 High 7.7 DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal 0.3%
• CVE-2026-24836 High 7.7 DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes 0.3%
• CVE-2026-24833 High 7.7 DotNetNuke.Core Vulnerable to Stored XSS in Module Description 0.2%
• CVE-2026-24784 Medium 6.8 DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer 0.2%
• CVE-2025-64095 Critical 10.0 DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite 47.0%
• CVE-2025-64094 Medium 6.4 DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload 0.2%
• CVE-2025-62802 Medium 4.3 DNN CKEditor Provider allows unauthenticated upload out-of-the-box 0.2%
• CVE-2025-59548 Medium 5.9 DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser 0.2%
• CVE-2025-59547 Medium 5.3 DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation 0.3%
• CVE-2025-59821 Medium 6.5 DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile 0.2%
• CVE-2025-59546 Low 2.4 DNN Vulnerable to Stored XSS Using Backend Admin Credentials 0.2%
• CVE-2025-59545 Critical 9.1 DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module 0.5%
• CVE-2025-59539 Medium 6.3 DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field 0.2%
• CVE-2025-59535 Medium 6.5 DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters 0.4%
• CVE-2025-52488 High 8.6 DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input 35.8%
• CVE-2025-52487 High 8.8 DNN.PLATFORM possibly allows bypass of IP Filters 0.3%
• CVE-2025-52486 Medium 6.1 DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects 0.2%
• CVE-2025-52485 Medium 5.1 DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed 0.2%
• CVE-2025-48377 Medium 6.0 Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode 0.2%
• CVE-2025-48378 Medium 6.1 Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline 0.3%
• CVE-2025-48376 Low 3.5 Dnn.Platform's Site Import could use an external source with a crafted request 0.3%
• CVE-2025-32374 Medium 5.9 Possible Denial of Service (DoS) in DNN.PLATFORM registration 0.4%
• CVE-2025-32373 Medium 6.5 DNN allows a registered user to enumerate and access files they should not have access to 0.4%
• CVE-2025-32372 Medium 6.5 Server-Side Request Forgery (SSRF) in DotNetNuke.Core 0.4%
• CVE-2025-32371 Medium 4.3 Unexpected external content may be displayed in DNN ImageHandler 0.3%