Dnnsoftware Dnn.platform vulnerabilities

• dnnsoftware dotnetnuke, dnn.platform +1 more DNN has same HostGUID for all new installs CVE-2026-40306 Fix available 6.9 MediumApril 10, 2026
• dnnsoftware dotnetnuke, dnn.platform +1 more DNN has Force Friend Request Acceptance CVE-2026-40305 Fix available 4.3 MediumApril 10, 2026
• dnnsoftware dotnetnuke, dnn.platform +1 more DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload CVE-2026-40321 Fix available 8.1 HighApril 10, 2026
• dnnsoftware dotnetnuke, dnn.platform +1 more DotNetNuke.Core Vulnerable to Stored XSS via Module Title CVE-2026-24838 Fix available 9.1 CriticalJanuary 27, 2026
• dnnsoftware dotnetnuke, dnn.platform +1 more DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal CVE-2026-24837 Fix available 7.7 HighJanuary 27, 2026
• dnnsoftware dotnetnuke, dnn.platform +1 more DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes CVE-2026-24836 Fix available 7.7 HighJanuary 27, 2026
• dnnsoftware dotnetnuke, dnn.platform +1 more DotNetNuke.Core Vulnerable to Stored XSS in Module Description CVE-2026-24833 7.7 HighJanuary 27, 2026
• dnnsoftware dotnetnuke, dnn.platform +1 more DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer CVE-2026-24784 Fix available 6.8 MediumJanuary 27, 2026
• dnnsoftware dotnetnuke, dnn.platform +1 more DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite CVE-2025-64095 Public exploitFix available EPSS 47.0% 10.0 CriticalOctober 28, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload CVE-2025-64094 Fix available 6.4 MediumOctober 28, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more DNN CKEditor Provider allows unauthenticated upload out-of-the-box CVE-2025-62802 Fix available 4.3 MediumOctober 28, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser CVE-2025-59548 5.9 MediumSeptember 23, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation CVE-2025-59547 5.3 MediumSeptember 23, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile CVE-2025-59821 Fix available 6.5 MediumSeptember 23, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more DNN Vulnerable to Stored XSS Using Backend Admin Credentials CVE-2025-59546 Fix available 2.4 LowSeptember 23, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module CVE-2025-59545 Fix available 9.1 CriticalSeptember 23, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field CVE-2025-59539 Fix available 6.3 MediumSeptember 22, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters CVE-2025-59535 Fix available 6.5 MediumSeptember 22, 2025
• dnnsoftware dnn.platform, dotnetnuke +1 more DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input CVE-2025-52488 Public exploitFix available EPSS 35.8% 8.6 HighJune 20, 2025
• dnnsoftware dnn.platform, dotnetnuke +1 more DNN.PLATFORM possibly allows bypass of IP Filters CVE-2025-52487 Fix available 8.8 HighJune 20, 2025
• dnnsoftware dnn.platform, dotnetnuke +1 more DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed CVE-2025-52485 Fix available 5.1 MediumJune 20, 2025
• dnnsoftware dnn.platform, dotnetnuke +1 more DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects CVE-2025-52486 Fix available 6.1 MediumJune 20, 2025
• dnnsoftware dnn.platform, dotnetnuke +1 more Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode CVE-2025-48377 Fix available 6.0 MediumMay 23, 2025
• dnnsoftware dnn.platform, dotnetnuke +1 more Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline CVE-2025-48378 Fix available 6.1 MediumMay 23, 2025
• dnnsoftware dnn.platform, dotnetnuke +1 more Dnn.Platform's Site Import could use an external source with a crafted request CVE-2025-48376 Fix available 3.5 LowMay 23, 2025
• dnnsoftware dnn.platform, dotnetnuke +1 more Possible Denial of Service (DoS) in DNN.PLATFORM registration CVE-2025-32374 5.9 MediumApril 9, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more DNN allows a registered user to enumerate and access files they should not have access to CVE-2025-32373 6.5 MediumApril 9, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more Unexpected external content may be displayed in DNN ImageHandler CVE-2025-32371 4.3 MediumApril 9, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more Server-Side Request Forgery (SSRF) in DotNetNuke.Core CVE-2025-32372 Fix available 6.5 MediumApril 9, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more DNN allows the possibility of bypassing Captcha CVE-2025-32036 4.2 MediumApril 8, 2025
• dnnsoftware dotnetnuke, dnn.platform +1 more DNN does not check the contents of a file when uploading files CVE-2025-32035 2.6 LowApril 8, 2025
• dnnsoftware dnnsoftware/dnn.platform, dotnetnuke +1 more Relative Path Traversal in dnnsoftware/dnn.platform CVE-2022-2922 Fix available 4.9 MediumSeptember 30, 2022