CVE-2018-15811VulnerabilityPublished 11/03/2021Updated 10/24/2026
CVE-2018-15811: DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
Affects DotNetNuke (DNN) DotNetNuke (DNN)Source CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 11/03/2021
- KEV deadline
- 05/03/2022
- EPSS
- 76.3% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
DotNetNuke (DNN) suffers from a vulnerability due to the use of weak encryption algorithms to protect input parameters. This inadequate encryption strength can potentially be exploited to compromise the confidentiality or integrity of data handled by the application. The vulnerability is known to be exploited in the wild, indicating active threat activity targeting affected systems.