CVE-2025-52485 DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue...

DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

DNN.PLATFORM allows a specially crafted request can inject scripts in the Activity Feed Attachments endpoint which will then render in the feed, resulting in a cross-site scripting attack. This vulnerability is fixed in 10.0.1...

GHSA-WWC9-WMM3-2PMF DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

DNN.PLATFORM allows a specially crafted request can inject scripts in the Activity Feed Attachments endpoint which will then render in the feed, resulting in a cross-site scripting attack. This vulnerability is fixed in 10.0.1...

Dotnetnuke < 10.0.1 Stored Cross-Site Scripting (XSS) in Activity Feed (CVE-2025-52485)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.0.1. It is, therefore, affected by a vulnerability. - DNN.PLATFORM Allows Stored Cross-Site Scripting XSS in Activity Feed CVE-2025-52485 Note that Nessus has not tested for this iss...

Dotnetnuke < 10.0.1 Stored Cross-Site Scripting (XSS) in Activity Feed (GHSA-wwc9-wmm3-2pmf)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.0.1. It is, therefore, affected by a vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

CVE-2025-5210

creationtimestamp| type| source ---|---|--- 2025-05-26 22:48:07+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17580 2025-05-26 23:42:02+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lq4dxavqia72 2025-05-26...

CVE-2025-45859

creationtimestamp| type| source ---|---|--- 2025-05-13 15:31:30+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lp2rmklzyrz2 2025-05-13 16:47:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lp2wst4mo42l 2025-05-13...

CVE-2025-4527

creationtimestamp| type| source ---|---|--- 2025-05-11 04:03:07+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3louhw26stma2 2025-05-11 04:36:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loumzwdzbf2j 2025-05-11...

CVE-2025-24514

creationtimestamp| type| source ---|---|--- 2025-03-24 17:55:00+00:00| seen| https://thehackernews.com/2025/03/critical-ingress-nginx-controller.html 2025-03-24 21:56:48+00:00| seen| https://bsky.app/profile/lookitup.baby/post/3ll5qr5t6uk2k 2025-03-24 22:01:06+00:00| seen|...

The vulnerability in the DNN CMS system’s script execution scenario /Activity-Feed/userId/{user_id}, which allows a attacker to perform XSS attacks.

Vulnerability of the DNN CMS system’s /Activity-Feed/userId/userid endpoint: no measures taken to protect the website structure. Exploitation of this vulnerability allows a malicious actor to perform XSS attacks remotely...

PT-2025-26481

Name of the Vulnerable Software and Affected Versions: DNN formerly DotNetNuke versions 6.0.0 through 10.0.0 Description: The issue allows a specially crafted request to inject scripts in the "Activity Feed Attachments" endpoint, which will then render in the feed, resulting in a cross-site...

CVE-2021-44523

A vulnerability has been identified in SiPass integrated V2.76 All versions, SiPass integrated V2.80 All versions, SiPass integrated V2.85 All versions, Siveillance Identity V1.5 All versions, Siveillance Identity V1.6 All versions V1.6.284.0. Affected applications insufficiently limit the access...

CVE-2021-44523

A vulnerability has been identified in SiPass integrated V2.76 All versions, SiPass integrated V2.80 All versions, SiPass integrated V2.85 All versions, Siveillance Identity V1.5 All versions, Siveillance Identity V1.6 All versions V1.6.284.0. Affected applications insufficiently limit the access...

CVE-2021-44523

A vulnerability has been identified in SiPass integrated V2.76 All versions, SiPass integrated V2.80 All versions, SiPass integrated V2.85 All versions, Siveillance Identity V1.5 All versions, Siveillance Identity V1.6 All versions V1.6.284.0. Affected applications insufficiently limit the access...

CVE-2020-11585

There is an information disclosure issue in DNN formerly DotNetNuke 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager other than ones contained in a secure folder by sending themselves a message...

CVE-2020-11585

There is an information disclosure issue in DNN formerly DotNetNuke 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager other than ones contained in a secure folder by sending themselves a message...

Information disclosure

There is an information disclosure issue in DNN formerly DotNetNuke 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager other than ones contained in a secure folder by sending themselves a message...

CVE-2020-11585

There is an information disclosure issue in DNN formerly DotNetNuke 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager other than ones contained in a secure folder by sending themselves a message...

Gitlab -- multiple vulnerabilities

Gitlab reports: Wiki XSS Sanitize gem updates XSS in urlforparams Content injection via username Activity feed publicly displaying internal project names Persistent XSS in charts...

Prevent Activity feed information leakage by allowing permanently disabling of it

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Cloud. Using JIRA Server? See the corresponding suggestion|http://jira.atlassian.com/browse/JRASERVER-45601. panel It seems that the sensitive information leakage is something almost impossible to avoid when you have a pair of JIRA instances,...