Actively exploited in the wild

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

DotNetNuke (DNN) - DotNetNuke (DNN) · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2018-18325

HighCVSS 7.5KEV

Published: 03/07/2019(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

Risk Assessment

Weak encryption of parameters could allow an attacker to decrypt or manipulate data, potentially leading to unauthorized access or attacks.

Recommendation

Update DNN to a version that includes the complete fix for CVE-2018-15811.

Other vulnerabilities in DNN (DotNetNuke)

CVE-2018-15811HighActively exploited
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

Original NVD description (English source)

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.