CVE-2025-59545
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
The Prompt module in DNN (DotNetNuke) before version 10.1.0 allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display, can be executed when processed through certain commands, leading to potential script execution (XSS). Patched in version 10.1.0.
Risk Assessment
An attacker can exploit XSS to steal sessions, modify content, or perform unauthorized actions in the context of a logged-in user.
Recommendation
Update DNN to version 10.1.0 or later which includes the fix. Additionally, apply XSS protections such as CSP headers.
Other vulnerabilities in DNN (DotNetNuke)
See all- CVE-2018-18325HighActively exploited
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
- CVE-2018-15811HighActively exploited
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
Original NVD description (English source)
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution (XSS). This issue has been patched in version 10.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS