GitHub Advisoryadvisory · NuGet

GHSA-gj8m-5492-q98h DNN Vulnerable to Stored XSS Using Backend Admin Credentials

LOW Published 2025-09-23 Modified 2025-09-23 Official page ↗
Aliases
CVE-2025-59546
Ecosystem
NuGet
Packages
DotNetNuke.Core
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-09-23

Affected packages

• NuGet DotNetNuke.Core: < 10.1.0 → fixed in 10.1.0

Description

Summary Users that can edit modules could set a title that includes scripts. Description Some users (administrators and content editors) can set html in module titles and that could include javascript which could be used for XSS based attacks. With the addition of more roles being able to set module titles, this is not strictly limited to administrators. However since HTML in module titles could be a valid use case, we have added a setting for this functionality in the Security module in the Persona Bar.

Related

Alias · CVE (1)

  • CVE-2025-59546 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References