DotNetNuke.Core vulnerabilities (NuGet)

36 vulnerabilities.

• DotNetNuke.Core NuGet DotNetNuke.Core security code analysis rules triggered GHSA-fcpv-w245-r2q7 Fix available No scoreApril 14, 2026
• DotNetNuke.Core NuGet DNN has same HostGUID for all new installs CVE-2026-40306 Fix available 6.9 MediumApril 10, 2026
• DotNetNuke.Core NuGet DNN has Force Friend Request Acceptance CVE-2026-40305 Fix available 4.3 MediumApril 10, 2026
• DotNetNuke.Core NuGet DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload CVE-2026-40321 Fix available 8.1 HighApril 10, 2026
• DotNetNuke.Core NuGet DotNetNuke.Core Vulnerable to Stored XSS via Module Title CVE-2026-24838 Fix available 9.1 CriticalJanuary 27, 2026
• DotNetNuke.Core NuGet DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal CVE-2026-24837 Fix available 7.7 HighJanuary 27, 2026
• DotNetNuke.Core NuGet DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes CVE-2026-24836 Fix available 7.7 HighJanuary 27, 2026
• DotNetNuke.Core NuGet DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer CVE-2026-24784 Fix available 6.8 MediumJanuary 27, 2026
• DotNetNuke.Core NuGet DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload CVE-2025-64094 Fix available 6.4 MediumOctober 28, 2025
• DotNetNuke.Core NuGet DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile CVE-2025-59821 Fix available 6.5 MediumSeptember 23, 2025
• DotNetNuke.Core NuGet DNN Vulnerable to Stored XSS Using Backend Admin Credentials CVE-2025-59546 Fix available 2.4 LowSeptember 23, 2025
• DotNetNuke.Core NuGet DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module CVE-2025-59545 Fix available 9.1 CriticalSeptember 23, 2025
• DotNetNuke.Core NuGet DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field CVE-2025-59539 Fix available 6.3 MediumSeptember 22, 2025
• DotNetNuke.Core NuGet DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters CVE-2025-59535 Fix available 6.5 MediumSeptember 22, 2025
• DotNetNuke.Core NuGet Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode CVE-2025-48377 Fix available 6.0 MediumMay 23, 2025
• DotNetNuke.Core NuGet Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline CVE-2025-48378 Fix available 6.1 MediumMay 23, 2025
• DotNetNuke.Core NuGet Server-Side Request Forgery (SSRF) in DotNetNuke.Core CVE-2025-32372 Fix available 6.5 MediumApril 9, 2025
• DotNetNuke.Core NuGet Relative Path Traversal in dnnsoftware/dnn.platform CVE-2022-2922 Fix available 4.9 MediumSeptember 30, 2022
• DotNetNuke.Core NuGet DNN XSS Vulnerability CVE-2020-5186 5.4 MediumFebruary 24, 2020
• DotNetNuke.Core NuGet DNN Path Traversal via Zip Slip CVE-2020-5187 Fix available 8.8 HighFebruary 24, 2020
• DotNetNuke.Core NuGet DNN File Upload Vulnerability CVE-2020-5188 6.5 MediumFebruary 24, 2020
• DotNetNuke.Core NuGet Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke CVE-2019-12562 Public exploitFix available 6.1 MediumSeptember 26, 2019
• DotNetNuke.Core NuGet Insufficient Entropy in DotNetNuke CVE-2018-18326 Public exploitFix available EPSS 54.3% 7.5 HighJuly 3, 2019
• DotNetNuke.Core NuGet Inadequate Encryption Strength in DotNetNuke CVE-2018-18325 In KEVPublic exploitFix available EPSS 74.0% 7.5 HighJuly 3, 2019
• DotNetNuke.Core NuGet Insufficient Entropy in DotNetNuke CVE-2018-15812 Public exploitFix available EPSS 47.2% 7.5 HighJuly 3, 2019
• DotNetNuke.Core NuGet Inadequate Encryption Strength in DotNetNuke CVE-2018-15811 In KEVPublic exploitFix available EPSS 76.3% 7.5 HighJuly 3, 2019
• DotNetNuke.Core NuGet DNN XSS Vulnerability CVE-2018-14486 6.1 MediumMarch 17, 2019
• DotNetNuke.Core NuGet High severity vulnerability that affects DotNetNuke.Core CVE-2017-0929 Fix available EPSS 12.5% 7.5 HighJuly 3, 2018
• DotNetNuke.Core NuGet DNN (aka DotNetNuke) has Remote Code Execution via a cookie CVE-2017-9822 In KEVPublic exploitFix available EPSS 94.8% 8.8 HighJuly 20, 2017
• DotNetNuke.Core NuGet The installation wizard in DotNetNuke (DNN) allows privilege escalation CVE-2015-2794 Public exploitFix available EPSS 75.1% 9.8 CriticalFebruary 6, 2017
• DotNetNuke.Core NuGet Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) CVE-2016-7119 Fix available 5.4 MediumAugust 31, 2016
• DotNetNuke.Core NuGet Moderate severity vulnerability that affects DotNetNuke.Core CVE-2015-1566 Fix available 4.3 MediumFebruary 9, 2015
• DotNetNuke.Core NuGet DotNetNuke (DNN) Open redirect vulnerability CVE-2013-7335 Fix available 4.3 MediumMarch 12, 2014
• DotNetNuke.Core NuGet DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter CVE-2013-4649 Fix available 4.3 MediumMarch 12, 2014
• DotNetNuke.Core NuGet DotNetNuke Default Machine Key Exposure CVE-2008-6540 Public exploitFix available 5.1 MediumMarch 30, 2009
• DotNetNuke.Core NuGet DotNetNuke Vulnerable to XSS in Pass-Through Values CVE-2007-0660 Fix available 6.8 MediumFebruary 1, 2007