Cross-site Scripting (XSS)

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization, via XML. Details Cross-site scripting or XSS is a code...

GHSA-M6W9-8CXC-JFF7 DNN XSS Vulnerability

DNN formerly DotNetNuke 9.1.1 allows cross-site scripting XSS via XML...

DotNetNuke Vulnerable to XSS in Pass-Through Values

Cross-site scripting XSS vulnerability in the IFrame module before 03.02.01 for DotNetNuke DNN, caused by improper validation of user-supplied input by an unspecified script. Pass through values were not getting filtered, leaving them vulnerable to XSS. A remote attacker could exploit this...

GHSA-XR96-7CCP-PG5C DotNetNuke Vulnerable to XSS in Pass-Through Values

Cross-site scripting XSS vulnerability in the IFrame module before 03.02.01 for DotNetNuke DNN, caused by improper validation of user-supplied input by an unspecified script. Pass through values were not getting filtered, leaving them vulnerable to XSS. A remote attacker could exploit this...

The vulnerability of the DNN CMS system, related to insufficiently secure data encryption, allows attackers to gain unauthorized access to protected information.

The vulnerability of the DNN CMS system is related to insufficiently secure data encryption. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the DNN CMS system, related to insufficient protection of cookie files, allows a hacker to gain unauthorized access to protected information and execute arbitrary code.

The vulnerability of the DNN CMS system is related to insufficient protection of cookie files. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information and execute arbitrary code...

K8tools

It is an offensive tool for web application exploitation. The repository, K8tools, contains a collection of tools for various purposes, including internal penetration, privilege escalation, remote overflow, vulnerability exploitation, scanning, password cracking, and evasion. The primary focus is...

VulnCheck KEV: CVE-2018-15811

DotNetNuke DNN contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters...

VulnCheck KEV: CVE-2018-18325

DotNetNuke DNN contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811...

DotNetNuke (DNN) Remote Code Execution Vulnerability

DotNetNuke DNN contains a vulnerability that may allow for remote code execution via cookie deserialization...

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

DotNetNuke DNN contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811...

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

DotNetNuke DNN contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters...

DNN (DotNetNuke) 9.2 <= 9.2.2 Weak Encryption Algorithm Vulnerability

The version of DNN Platform formerly DotNetNuke running on the remote host is 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

VulnCheck KEV: CVE-2017-9822

DotNetNuke DNN contains a vulnerability that may allow for remote code execution via cookie deserialization...

K8tools

It is an offensive tool for web application exploitation. The repository, K8tools, contains a collection of tools for various purposes, including internal penetration, privilege escalation, remote overflow, vulnerability exploitation, scanning, password cracking, and evasion. The primary focus is...

K8tools

It is an offensive tool for web application exploitation. The repository, K8tools, contains a collection of tools for various purposes, including internal penetration, privilege escalation, remote overflow, vulnerability exploitation, scanning, password cracking, and anti-kill tools. The primary...

Dotnetnuke 5.0.x < 9.6.1 (09.06.01)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is 5.0.x prior to 9.6.1. It is, therefore, affected by a vulnerability. - The maintainers of jQuery published version 3.5.0 with a security fix included regarding HTML manipulation. Fixes for this...

Dotnetnuke 7.0.x < 9.5.0 XSS

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is 7.0.x prior to 9.5.0. It is, therefore, affected by a XSS vulnerability. - For websites with user registration enabled, it is possible for a user to craft a registration that would inject...

Dotnetnuke 3.1.x < 9.6.0 / 5.0.x < 9.6.0 / 6.0.x < 9.6.0 / 7.0.x < 9.6.0 Multiple Vulnerabilities (09.06.00)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is 3.1.x prior to 9.6.0, 5.0.x prior to 9.6.0, 6.0.x prior to 9.6.0, or 7.0.x prior to 9.6.0. It is, therefore, affected by multiple vulnerabilities. - Modules that were discarded to the recycle bi...

U.S. Dept Of Defense: Remote Code Execution through DNN Cookie Deserialization

Summary: The application at https://████████ presents a deserialization vulnerability that permits RCE and file read/write Step-by-step Reproduction Instructions 1. Navigate to a random page that must return a 404 Error status like https://████/test 2. Add this cookie in the request header:...