CVE-2025-64095

🗓️ 28 Oct 2025 21:46:11Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 36 Views🌐 WEB

Unauthenticated image uploads allow overwriting files and defacing DNN sites before version 10.1.1; fixed in 10.1.1.

Reporter	Title	Published	Views	Family All 20
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Dnnsoftware Dotnetnuke	6 Nov 202520:20	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Dnnsoftware Dotnetnuke	18 Nov 202518:53	–	githubexploit
Circl	CVE-2025-64095	29 Oct 202500:01	–	circl
CNNVD	DNN 代码问题漏洞	28 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-64095 DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite	28 Oct 202521:46	–	cvelist
EUVD	EUVD-2025-36564	29 Oct 202521:48	–	euvd
Github Security Blog	DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite	29 Oct 202521:48	–	github
Hacker One	U.S. Dept Of Defense: DNN - Unrestricted Arbitrary File Upload #████████	6 Nov 202511:53	–	hackerone
Nuclei	DNN - Unrestricted Arbitrary File Upload	4 Feb 202607:00	–	nuclei
NVD	CVE-2025-64095	28 Oct 202522:15	–	nvd

NVD

Vulners

Node

dnnsoftware dotnetnukeRange<10.1.1

[
  {
    "vendor": "dnnsoftware",
    "product": "Dnn.Platform",
    "versions": [
      {
        "version": "< 10.1.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-3m8r-w7xg-jqvw

Parameter	Position	Path	Description	CWE
upload	request body	Providers/HtmlEditorProviders/DNNConnect.CKE/Upload.ashx	Unauthenticated arbitrary file upload via the HTML editor upload endpoint (leading to potential file overwrite/defacement).	CWE-434

17 Jun 2026 09:53Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.19.8 - 10

EPSS0.44185

SSVC