GitHub Advisoryadvisory · NuGet

GHSA-7rcc-q6rq-jpcm DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

MEDIUM Published 2025-09-22 Modified 2025-09-23 Official page ↗
Aliases
CVE-2025-59539
Ecosystem
NuGet
Packages
DotNetNuke.Core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-79
Reviewed
2025-09-22

Affected packages

• NuGet DotNetNuke.Core: < 10.1.0 → fixed in 10.1.0

Description

Summary Users can use special syntax to inject javascript code in their profile biography field. Although there was sanitization in place, it did not cover all possible scenarios Description When embedding information in the `Biography` field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers.

Related

Alias · CVE (1)

  • CVE-2025-59539 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References