Improper Enforcement of Behavioral Workflow

Overview DotNetNuke.SiteExportImport is an A package containing components required for developing extensions to utilize site export/import features of DotNetNuke. Affected versions of this package are vulnerable to Improper Enforcement of Behavioral Workflow via the site import feature. A...

Cross-site Scripting (XSS)

Overview DotNetNuke.Web is a provides references to core components such as Caching, Security and other security-related items for DNN Platform Affected versions of this package are vulnerable to Cross-site Scripting XSS via module actions when in edit mode. An attacker can execute scripts in the...

Cross-site Scripting (XSS)

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via module actions when in edit mode. An attacker can execute scripts in the context of the user's brows...

CVE-2022-47053

An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file...

DNN 跨站脚本漏洞

DNN also known as DotNetNuke is a set of American DNN company by Microsoft support, based on the ASP.NET platform of open source content management system CMS. The system is easy to install, scalable, feature-rich and so on. A cross-site scripting vulnerability exists in versions prior to DNN...

DNN 跨站脚本漏洞

DNN also known as DotNetNuke is a set of American DNN company by Microsoft support, based on the ASP.NET platform of open source content management system CMS. The system is easy to install, scalable, feature-rich and so on. A cross-site scripting vulnerability exists in DNN versions prior to...

DNN 安全漏洞

DNN aka DotNetNuke is a Microsoft-supported, open-source content management system CMS based on the ASP.NET platform from the U.S. company DNN. The system is easy to install, scalable, feature-rich and so on. A security vulnerability exists in DNN versions prior to 9.13.9, which originates from a...

CVE-2020-11585

There is an information disclosure issue in DNN formerly DotNetNuke 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager other than ones contained in a secure folder by sending themselves a message...

CVE-2020-5188

DNN formerly DotNetNuke through 9.4.4 has Insecure Permissions...

CVE-2010-4514

Cross-site scripting XSS vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the VIEWSTATE parameter. NOTE: some of these details are obtained from third party information...

CVE-2013-7335

Open redirect vulnerability in DotNetNuke DNN before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2018-15811

DNN aka DotNetNuke 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters...

CVE-2012-1036

Cross-site scripting XSS vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message...

CVE-2015-1566

Cross-site scripting XSS vulnerability in DotNetNuke DNN before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-10138

The CATALooK.netStore module through 7.2.8 for DNN formerly DotNetNuke allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImageViewer.aspx link or desc parameter...

CVE-2012-1030

Cross-site scripting XSS vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup...

User Interface (UI) Misrepresentation of Critical Information

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to User Interface UI Misrepresentation of Critical Information in the GenerateImage function, which does not sanitize URL text. An...

Authorization Bypass Through User-Controlled Key

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key that allows an attacker to enumerate sensitive files by manipulating request...

CVE-2025-32374 Possible Denial of Service (DoS) in DNN.PLATFORM registration

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Possible denial of service with specially crafted information in the public registration form. This vulnerability is fixed in 9.13.8...

CVE-2025-32374 Possible Denial of Service (DoS) in DNN.PLATFORM registration

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Possible denial of service with specially crafted information in the public registration form. This vulnerability is fixed in 9.13.8...