DNN vulnerabilities

Insufficient sanitization of uploaded SVG files in DNN (DotNetNuke) before version 10.1.1. This is an incomplete fix for CVE-2025-48378, not covering all XSS scenarios.

DNN (formerly DotNetNuke) prior to 10.1.1 allows unauthenticated users to upload files in the out-of-box experience for HTML editing. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.

DNN (formerly DotNetNuke), an open-source web content management platform (CMS) in the Microsoft ecosystem, prior to version 10.1.0 allowed users to inject JavaScript code in the Biography field, even if that field is not rich-text. The injected code would run in the context of the website for any user viewing the profile, including administrators and/or superusers. This issue has been patched in version 10.1.0.