{"id":"CVE-2013-4649","aliases":["EUVD-2022-5239","GHSA-rvrj-j7cc-236p"],"status":"published","title":"DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter","description":"Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02467,"percentile":0.84588,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2014-03-12T14:00:00Z","modified":"2026-06-16T23:57:39Z","fixes":[{"ecosystem":"NuGet","package":"DotNetNuke.Core","fixed_in":["6.2.9","7.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"DotNetNuke.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.9"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"DotNetNuke.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0"},{"fixed":"7.1.1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"DotNetNuke.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.9"}]}],"versions":["6.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"DotNetNuke.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0"},{"fixed":"7.1.1"}]}],"versions":["7.0.0","7.0.6.121","7.1.0"]}],"products":[{"vendor":"dnnsoftware","product":"dotnetnuke"}],"references":[{"url":"http://secunia.com/advisories/53493","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","web"]},{"url":"http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html","tags":["x_refsource_MISC","x_transferred","Exploit","web"]},{"url":"http://www.dnnsoftware.com/platform/manage/security-center","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86432","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4649","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rvrj-j7cc-236p"},{"url":"https://github.com/dnnsoftware/Dnn.Platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2013-4649","description":"Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.","status":"published","published":"2014-03-12T14:00:00Z","modified":"2024-08-06T16:52:27.001Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2022-5239","description":"Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.","status":"published","published":"2014-03-12T14:00:00Z","modified":"2024-08-06T16:52:27Z","updated_at":"2026-11-03T01:56:30.535587Z"}],"ghsa":[{"id":"GHSA-rvrj-j7cc-236p","title":"DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter","description":"Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.","status":"published","published":"2022-05-17T01:33:02Z","modified":"2023-08-28T23:44:05Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2013-4649","description":"Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.","status":"published","published":"2014-03-12T14:55:30.677Z","modified":"2026-06-16T23:57:39.37Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:50.049023Z"}],"osv":[{"id":"GHSA-rvrj-j7cc-236p","title":"DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter","description":"Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.","status":"published","published":"2022-05-17T01:33:02Z","modified":"2024-12-05T05:27:28.028351Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:56.281047Z"}]}}