DNN has same HostGUID for all new installs

DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters

DNN allows a registered user to enumerate and access files they should not have access to

DNN allows the possibility of bypassing Captcha

DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser

DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile

DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects

DotNetNuke.Core Vulnerable to Stored XSS via Module Title

DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

DotNetNuke.Core Vulnerable to Stored XSS in Module Description

DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode

Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline

DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation

DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer

DNN Vulnerable to Stored XSS Using Backend Admin Credentials

DNN has Force Friend Request Acceptance

DNN CKEditor Provider allows unauthenticated upload out-of-the-box

Unexpected external content may be displayed in DNN ImageHandler