CVE-2025-59539
DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0.
- Record
CVE-2025-59539- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-30452
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0.
- Record
EUVD-2025-30452- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7rcc-q6rq-jpcm
DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field
Summary
Users can use special syntax to inject javascript code in their profile biography field. Although there was sanitization in place, it did not cover all possible scenarios
Description
When embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers.
- Record
GHSA-7rcc-q6rq-jpcm- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0.
- Record
CVE-2025-59539- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0.
- Record
CVE-2025-59539- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-7rcc-q6rq-jpcm
DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field
Summary
Users can use special syntax to inject javascript code in their profile biography field. Although there was sanitization in place, it did not cover all possible scenarios
Description
When embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers.
- Record
GHSA-7rcc-q6rq-jpcm- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
DotNetNuke.CoreNuGet |
before 10.1.0 | 10.1.0 |
DotNetNuke.CoreNuGet |
before 10.1.0, plus listed versions 10.0.010.0.16.0.07.0.07.0.6.121 Show 45 moreShow less7.1.07.1.27.2.0.6137.3.0.4997.3.1.207.4.0.3537.4.1.2807.4.2.2168.0.0.8098.0.1.2398.0.2.48.0.3.58.0.4.2269.0.0.10029.0.1.1429.1.0.3679.1.1.1299.10.09.10.19.10.29.11.09.11.19.11.29.12.09.13.09.13.0-ci00009.13.19.13.29.13.39.13.49.13.59.13.5-ci00629.13.69.13.79.13.7-ci00649.13.89.13.99.2.0.3669.2.1.5339.3.09.3.19.3.29.4.09.4.19.4.2 |
10.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-59539 is a medium vulnerability (CVSS 6.3) in Dnnsoftware Dotnetnuke, published September 22, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in DotNetNuke.Core 10.1.0.
References
Left out here: 11 versions. The JSON record has them.