CVE-2017-9822

DotNetNuke (DNN) cookie deserialization RCE (CVE-2017-9822) affects DNN before 9.1.1. The vulnerability arises from deserializing a crafted DNNPersonalization-like cookie, enabling remote code execution. Exploitation details and public proof points are documented in exploit references (e.g., Meta...

CVE-2025-52488

Summary (CVE-2025-52488) Affected: DNN Platform (formerly DotNetNuke), versions 6.0.0 up to before 10.0.1.Root cause: A specially crafted interaction vulnerability allows NTLM hashes to be disclosed to a third‑party SMB server via Unicode path normalization.Impact: Unauthenticated attackers could...

CVE-2020-5187

CVE-2020-5187 affects DNN (DotNetNuke) up to version 9.4.4, where path traversal was reported. Multiple connected sources describe a zip-slip/path-traversal issue arising from unsafe handling/validation of file paths during archive extraction, enabling an attacker to access or overwrite files out...

CVE-2026-40321

CVE-2026-40321 affects DotNetNuke (DNN). Versions prior to 10.2.2 allow stored cross-site scripting through specially crafted SVG uploads, enabling scripts to run in contexts for both authenticated and unauthenticated users; impact increases if the payload is executed by a power user. The issue i...

CVE-2025-52487

CVE-2025-52487 affects DNN.PLATFORM (DotNetNuke) prior to version 10.0.1. Versions 7.0.0 up to before 10.0.1 allow a specially crafted request or proxy to bypass the DNN Login IP Filters, enabling login attempts from IPs outside the allow list. The vulnerability is mitigated by upgrading to versi...