CVE-2019-12562

CVE-2019-12562 CVE-2019-12562 Межсайтовый скриптинг XSS с сохранением в DotNetNuke DNN версии до 9.4.0 позволяет удалённым злоумышленникам сохранять и внедрять вредоносный скрипт на страницу уведомлений администратора. Эксплойт может использоваться для выполнения любых действий с правами...

OSWE-Labs-Poc

OSWE - Laboratoires Laboratoires dockerisés pour la certification Web Expert OSWE. Préparation pour la formation AWAE à venir ... Autre projet : analyse de malwares et chasse aux cybermenaces https://github.com/svdwi/BlueBox Laboratoires disponibles pour l'OSWE 1. ATutor est un système de gestion...

DotNetNuke (DNN) ImageHandler <9.2.0 - Server-Side Request Forgery

DotNetNuke aka DNN before 9.2.0 suffers from a server-side request forgery vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources. id: CVE-2017-0929 info: name: DotNetNuke DNN ImageHandler 9.2.0 - Server-Side Request Forgery author...

DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been...

CVE-2017-9822

CVE-2017-9822 DotNetNuke souvent abrégé DNN est une plateforme CMS Content Management System et un framework d'application web basé sur la technologie ASP.NET de Microsoft. Informations principales Produit concerné : DotNetNuke DNN Platform – un CMS/portail .NET populaire. Date de publication :...

cve-2017-9822

CVE-2017-9822 Основная информация Настройка окружения Настройка отладки Анализ Отладка XmlSerializer Gadget атаки ObjectDataProvider ResourceDictionary От xml insecure deserialization к RCE CVE-2017-9822 DNN также известный как DotNetNuke до версии 9.1.1 допускает удалённое выполнение кода через...

DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization

DNN DotNetNuke versions 9.2 through 9.2.2 use a weak encryption algorithm to protect input parameters because of an incomplete fix for CVE-2018-15811. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code...

DotNetNuke 07.04.00 - Administration Authentication Bypass

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx. id: CVE-2015-2794 info: name: DotNetNuke 07.04.00 - Administration Authentication Bypass author: 0xr2r severity...

DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization

DNN DotNetNuke versions 9.2 through 9.2.1 use a weak encryption algorithm to protect input parameters. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution. id: CVE-2018-15811 info: name: DotNetNuke...

CVE-2025-52488

Exploit de divulgation de hachage NTLM par normalisation de chemin Unicode pour DNN CVE-2025-52488 Aperçu Cet exploit cible une vulnérabilité dans DNN anciennement DotNetNuke versions 6.0.0 à avant 10.0.1 qui permet aux attaquants de divulguer des hachages NTLM via des attaques de normalisation d...

CVE-2017-9822

CVE-2017-9822 DotNetNuke - Exécution de code à distance par désérialisation de cookie RCE Les versions de DotNetNuke DNN entre 5.0.0 et 9.3.0 sont affectées par une vulnérabilité de désérialisation qui conduit à une exécution de code à distance RCE. DotNetNuke utilise le cookie DNNPersonalization...

DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution

DotNetNuke DNN versions between 5.0.0 - 9.3.0 are affected by a deserialization vulnerability that leads to remote code execution. id: CVE-2017-9822 info: name: DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution author: milo2012 severity: high description: DotNetNuke DNN...

DNN_CVE-2015-2794

DNNCVE-2015-2794 Plugin NSE pour Nmap qui analyse une application web DotNetNuke DNN pour une vulnérabilité de contournement d'authentification d'administration CVE-2015-2794, EDB-ID: 39777...

DNN - Unrestricted Arbitrary File Upload

DNN formerly DotNetNuke \u003C 10.1.1 contains an unrestricted file upload vulnerability caused by the default HTML editor provider allowing unauthenticated file uploads and overwriting existing files, letting unauthenticated attackers deface websites and inject XSS payloads, exploit requires no...

The vulnerability of the DNN CMS system, related to insufficient validation of requests on the server side, allows a hacker to perform an SSRF attack.

The vulnerability of the DNN CMS system is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack...

CVE-2026-40305

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2...

CVE-2026-40306

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have the same Host GUID. This does not affect upgrades from 9.x.x. Version 10.2.2 patches the issue...

CVE-2026-40321

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased ...

DNN: Same HostGUID For All New Installs

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have the same Host GUID. This does not affect upgrades from 9.x.x. Version 10.2.2 patches the issue...

EUVD-2026-23170

SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architecture. In versions 6.0.0 through 6.0.2, a soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof...