CVEvulnerability

CVE-2025-59535

6.5 MEDIUM Published 2025-09-22 Modified 2026-10-11 Official page ↗
Status
Analyzed
Published
2025-09-22
Last modified
2026-10-11
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-20, CWE-200, CWE-829

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.

Affected configurations

• dnnsoftware dotnetnuke (< 10.1.0)

Related

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References