Threats affecting pkg:github/dnnsoftware/Dnn.Platform

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have the same Host GUID. This does not affect upgrades from 9.x.x. Version 10.2.2 patches the issue.

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2 patches the issue.

CVE-2026-24838 is a critical cross-site scripting (XSS) vulnerability in the Dnn. Platform CMS affecting versions prior to 9.13.10 and between 10.0.0 and 10.2.0. The issue arises because module titles support rich text input that can include malicious scripts, which execute in certain scenarios without user interaction. Exploitation requires authenticated access but can lead to complete compromise of confidentiality, integrity, and availability of affected systems.

CVE-2026-24837 is a high-severity cross-site scripting (XSS) vulnerability in the Dnn. Platform CMS affecting versions from 9.0.0 up to but not including 9.13.10 and 10.2.0. The flaw arises because module friendly names can contain malicious scripts that execute during certain Persona Bar module operations. Exploitation requires authenticated users with high privileges and some user interaction, but can lead to complete compromise of confidentiality, integrity, and availability due to the scope of the vulnerability.

CVE-2026-24836 is a high-severity cross-site scripting (XSS) vulnerability affecting Dnn. Platform versions from 9.0.0 up to but not including 9.13.10, and from 10.0.0 up to but not including 10.2.0.

CVE-2026-24833 is a high-severity cross-site scripting (XSS) vulnerability in the Dnn. Platform CMS affecting versions prior to 9.13.10 and between 10.0.0 and 10.2.0. The flaw allows malicious scripts embedded in a module's richtext description field to execute within the Persona Bar interface, potentially compromising confidentiality, integrity, and availability. Exploitation requires authenticated access with high privileges and user interaction, but can lead to full session compromise and persistent code execution.

CVE-2026-24784 is a cross-site scripting (XSS) vulnerability in the Dnn. Platform CMS affecting versions from 9.0.0 up to but not including 9.13.10 and 10.2.0. The flaw allows a content editor with module header/footer editing privileges to inject malicious scripts that execute in the browsers of other users. The vulnerability requires authenticated access with elevated privileges but does not require user interaction to trigger once the malicious content is loaded.

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1.

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios. This vulnerability exists because of an incomplete fix for CVE-2025-48378. This vulnerability is fixed in 10.1.1.

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows specially crafted content in URLs to be used with TokenReplace and not be properly sanitized by some SkinObjects. This issue has been patched in version 10.0.1.