DO
Product
DotNetNuke
On CISA KEVExploited in the wildRansomware-linked
76
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 14Medium 32Low 1
Watch
Add DotNetNuke to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-40306 | 6.5 | Apr 17 | DNN has same HostGUID for all new installs Affected: 10.0.0 before 10.2.2 |
| CVE-2025-59535 | 6.5 | Sep 22 | DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters Affected: before 10.1.0 |
| CVE-2025-32373 | 6.5 | Apr 9 | DNN allows a registered user to enumerate and access files they should not have access to Affected: before 9.13.8 |
| CVE-2025-32036 | 6.5 | Apr 8 | DNN allows the possibility of bypassing Captcha Affected: before 9.13.8 |
| CVE-2020-5188 | 6.5 | Feb 24 | DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions Affected: through 9.4.4 |
| CVE-2025-59548 | 6.1 | Sep 23 | DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser Affected: before 10.1.0 |
| CVE-2025-59821 | 6.1 | Sep 23 | DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile Affected: before 10.1.0 |
| CVE-2025-52486 | 6.1 | Jun 21 | DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects Affected: 6.0.0 before 10.0.1 |
| CVE-2019-12562 | 6.1 | Sep 26 | Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page Affected: before 9.4.0 |
| CVE-2018-14486 | 6.1 | Mar 17 | DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML Affected: 9.1.1 |
| CVE-2020-37103 | 5.4 | Feb 3 | DotNetNuke 9.5 - Persistent Cross-Site Scripting Affected: through 9.5 |
| CVE-2026-24838 | 5.4 | Jan 27 | DotNetNuke.Core Vulnerable to Stored XSS via Module Title Affected: before 9.13.10; 10.0.0 before 10.2.0 |
| CVE-2026-24837 | 5.4 | Jan 27 | DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal Affected: 9.0.0 before 9.13.10; 10.0.0 before 10.2.0 |
| CVE-2026-24836 | 5.4 | Jan 27 | DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes Affected: 9.0.0 before 9.13.10; 10.0.0 before 10.2.0 |
| CVE-2026-24833 | 5.4 | Jan 27 | DotNetNuke.Core Vulnerable to Stored XSS in Module Description Affected: before 9.13.10; 10.0.0 before 10.2.0 |
| CVE-2025-64094 | 5.4 | Oct 28 | DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload Affected: before 10.1.1 |
| CVE-2025-59539 | 5.4 | Sep 23 | DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field Affected: before 10.1.0; 10.1.0 |
| CVE-2025-52485 | 5.4 | Jun 21 | DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed Affected: 6.0.0 before 10.0.1 |
| CVE-2025-48377 | 5.4 | May 23 | Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode Affected: before 9.13.9 |
| CVE-2025-48378 | 5.4 | May 23 | Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline Affected: before 9.13.9 |
| CVE-2022-47053 | 5.4 | Apr 12 | An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG… Affected: 7.0.0 through 9.10.2 |
| CVE-2021-31858 | 5.4 | Jul 20 | DotNetNuke (DNN) 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated users to inject… Affected: through 9.10.2 |
| CVE-2020-5186 | 5.4 | Feb 24 | DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2) Affected: through 9.4.4 |
| CVE-2016-7119 | 5.4 | Aug 31 | Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or… Affected: through 08.00.04 |
| CVE-2025-59547 | 5.3 | Sep 23 | DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation Affected: before 10.1.0 |
| CVE-2022-2922 | 4.9 | Sep 30 | Relative Path Traversal in dnnsoftware/dnn.platform Affected: before 9.11.0 |
| CVE-2026-24784 | 4.8 | Jan 27 | DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer Affected: 9.0.0 before 9.13.10; 10.0.0 before 10.2.0 |
| CVE-2025-59546 | 4.8 | Sep 23 | DNN Vulnerable to Stored XSS Using Backend Admin Credentials Affected: before 10.1.0 |
| CVE-2026-40305 | 4.3 | Apr 17 | DNN has Force Friend Request Acceptance Affected: 6.0.0 before 10.2.2 |
| CVE-2025-62802 | 4.3 | Oct 28 | DNN CKEditor Provider allows unauthenticated upload out-of-the-box Affected: before 10.1.1 |
| CVE-2025-32371 | 4.3 | Apr 9 | Unexpected external content may be displayed in DNN ImageHandler Affected: before 9.13.4 |
| CVE-2020-11585 | 4.3 | Apr 6 | There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module Affected: 9.5.0 |
Showing 32