CVE-2025-59821
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The DNN (formerly DotNetNuke) CMS platform in versions prior to 10.1.0 improperly handles URLs/paths and template rendering, allowing specially crafted input to be reflected into a user profile returned to the browser. The application does not sufficiently neutralize or encode HTML-significant characters, enabling an attacker to have victim browsers interpret attacker-controlled content as part of the page's HTML. The issue has been patched in version 10.1.0.
Risk Assessment
An attacker can cause malicious code to execute in the victim's browser, potentially leading to session or credential theft. All DNN installations older than 10.1.0 are at risk.
Recommendation
Update DNN to version 10.1.0 or later, which contains the fix for the vulnerability. Verify whether any custom modifications exist in the environment that may require additional review.
Other vulnerabilities in DNN
See all- CVE-2025-64095Critical
DNN (formerly DotNetNuke) prior to 10.1.1 allows unauthenticated file uploads via the default HTML editor, and images can overwrite existing files. An unauthenticated user can upload and replace files, enabling website defacement and XSS payload injection. This is fixed in 10.1.1.
- CVE-2025-64094Medium
Insufficient sanitization of uploaded SVG files in DNN (DotNetNuke) before version 10.1.1. This is an incomplete fix for CVE-2025-48378, not covering all XSS scenarios.
- CVE-2025-62802Medium
DNN (formerly DotNetNuke) prior to 10.1.1 allows unauthenticated users to upload files in the out-of-box experience for HTML editing. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.
- CVE-2025-59548Medium
DNN (formerly DotNetNuke) is a CMS platform. Prior to version 10.1.0, specially crafted URLs to the FileBrowser are vulnerable to JavaScript injection, affecting unsuspecting users clicking such links. This issue has been patched in version 10.1.0.
- CVE-2025-59547Medium
DNN (formerly DotNetNuke) is a CMS platform. Prior to version 10.1.0, the CKEditor file upload endpoint has insufficient filename sanitization allowing network endpoint probing. A crafted request can upload a file with Unicode characters translated into a path that could expose internal network resources. This is patched in version 10.1.0.
- CVE-2025-59546Low
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, administrators and content editors can set html in module titles that could include javascript which could be used for XSS based attacks. This issue has been patched in version 10.1.0.
- CVE-2025-59539Medium
DNN (formerly DotNetNuke), an open-source web content management platform (CMS) in the Microsoft ecosystem, prior to version 10.1.0 allowed users to inject JavaScript code in the Biography field, even if that field is not rich-text. The injected code would run in the context of the website for any user viewing the profile, including administrators and/or superusers. This issue has been patched in version 10.1.0.
- CVE-2025-59535Medium
DNN (formerly DotNetNuke) prior to version 10.1.0 allows arbitrary themes to be loaded through query parameters. If an installed theme had a vulnerability, it could be loaded on unsuspecting clients without the site owner's knowledge. This issue has been patched in version 10.1.0.
Original NVD description (English source)
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. In these cases, the application does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim’s browser to interpret attacker-controlled content as part of the page’s HTML. This issue has been patched in version 10.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS