GitHub Advisoryadvisory · NuGet

GHSA-2g5g-hcgh-q3rp DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

HIGH Published 2026-01-28 Modified 2026-01-28 Official page ↗

Aliases: CVE-2026-24836
Ecosystem: NuGet
Packages: DotNetNuke.Core
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weaknesses: CWE-79
Reviewed: 2026-01-28

Affected packages

• NuGet DotNetNuke.Core: >= 9.0.0, <= 9.13.9 (no fix yet) • NuGet DotNetNuke.Core: >= 10.0.0, < 10.02.0 → fixed in 10.02.0

Description

Extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed.

Related

Alias · CVE (1)

CVE-2026-24836 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. vulnerability

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References