Cross-Site Scripting (XSS)

Dnn.Platform is vulnerable to cross-site scripting XSS. The vulnerability exists as it allows XHTML tags such as...

Remote Code Execution (RCE)

DNN.Platform is vulnerable to remote code execution RCE. This is due to the application storing profile information for users in the DNNPersonalization cookie as XML and the structure includes a type attribute that instructs the server the type of object to create upon deserialization. The...

Insecure Encryption Key

Dnn.Platform uses an insecure encryption key. The vulnerability exists as it does not actually use an encrypted key as its key...

Information Disclosure

Dnn.Platform is vulnerable to information disclosure. The attack is due to the use of weak encryption algorithm to encrypt input parameters...

Cross-Site Scripting (XSS)

Dnn.Platform is vulnerable to cross-site scripting. A lack of sanitization in the redirect URL as displayed on the redirect page allows remote attackers to inject arbitrary Javascript into a victim's browser to steal session cookies or perform unwanted actions on behalf of the user...