CVE-2025-52486 DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows specially crafted content in URLs to be used with TokenReplace and not be properly sanitized by some SkinObjects. This issue has been...

CVE-2025-52486

CVE-2025-52486 affects DNN.PLATFORM (DotNetNuke) prior to 10.0.1, where specially crafted URL content could be used with TokenReplace and not be sanitized by certain SkinObjects, enabling a reflected Cross-Site Scripting (XSS). Affected versions are 6.0.0 through before 10.0.1. The issue is fixed...

CVE-2025-52486 DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows specially crafted content in URLs to be used with TokenReplace and not be properly sanitized by some SkinObjects. This issue has been...

CVE-2025-52485 DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue...

CVE-2025-52485 DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue...

CVE-2025-52485

CVE-2025-52485 affects DNN Platform (DotNetNuke) before version 10.0.1. Versions 6.0.0 to

CVE-2025-52485 DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue...

Dnn.Platform 信息泄露漏洞

Dnn.Platform is an open source web content management platform CMS open sourced by Dnn Software. An information disclosure vulnerability exists in versions of Dnn.Platform prior to 10.0.1, which stems from a malicious interaction that exposes an NTLM hash, potentially leading to information...

DNN.PLATFORM 跨站脚本漏洞

Dnn.Platform is an open source web content management platform CMS open sourced by Dnn Software. A cross-site scripting vulnerability exists in versions of DNN.PLATFORM prior to 10.0.1 that stems from improper URL content cleanup and could lead to cross-site scripting attacks...

Dnn.Platform 跨站脚本漏洞

Dnn.Platform is an open source web content management platform CMS open sourced by Dnn Software. A cross-site scripting vulnerability exists in Dnn.Platform versions prior to 10.0.1, which stems from a specially crafted request injection script that could lead to a cross-site scripting attack...

DNN.PLATFORM 安全漏洞

DNN.PLATFORM is an open source web content management platform CMS from DNN Open Source. A security vulnerability exists in DNN.PLATFORM versions prior to 10.0.1, which stems from a specially crafted request bypassing an IP filter design that could lead to unauthorized logins...

DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input

DNN.PLATFORM allows a specially crafted series of malicious interaction can expose NTLM hashes to a third party SMB server. This vulnerability is fixed in 10.0.1...

DNN.PLATFORM possibly allows bypass of IP Filters

DNN.PLATFORM allows a specially crafted request or proxy to be created that would bypass the design of DNN Login IP Filters allowing login attempts from IP Adresses not in the allow list. This vulnerability is fixed in 10.0.1...

GHSA-FJHG-3MRH-MM7H DNN.PLATFORM possibly allows bypass of IP Filters

DNN.PLATFORM allows a specially crafted request or proxy to be created that would bypass the design of DNN Login IP Filters allowing login attempts from IP Adresses not in the allow list. This vulnerability is fixed in 10.0.1...

PT-2025-26484 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN formerly DotNetNuke versions 6.0.0 through 10.0.0 Description: The issue allows a specially crafted series of malicious interactions to potentially expose NTLM hashes to a third-party SMB server. This is a problem in the DNN.PLATFORM, par...

PT-2025-26171 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: open5gs versions 2.7.2 and earlier Description: A missing length check in the ogs pfcp subnet add function from the PFCP library allows a local attacker to cause a Buffer Overflow by changing the session.dnn field with a value with length...

CVE-2025-44952

A missing length check in ogspfcpsubnetadd function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to cause a Buffer Overflow by changing the session.dnn field with a value with length greater than 101...

DNN < 9.13.9 DotNetNuke.Core Multiple Vulnerabilities

According to its self-reported version, the instance of DNN formerly DotNetNuke running on the remote web server is prior to 9.13.9. It is, therefore, affected by multiple vulnerabilities: - DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem...

CVE-2025-48378

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue...

CVE-2025-48376

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to version 9.13.9, a malicious SuperUser Host could craft a request to use an external url for a site export to then be imported. Version 9.13.9 fixes the issue...