CVE-2025-59535CWE-20CWE-200CWE-829information-disclosure

CVE-2025-59535

Medium · published September 23, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00428 · 36.0th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2025-09-23T01:16Z
Affected products (1)
ProductVersionsFixed in
dnnsoftware/dotnetnuke< 10.1.010.1.0
References (3)
https://github.com/dnnsoftware/Dnn.Platform/blob/develop/DNN%20Platform/Library/UI/Skins/Skin.cs#L305 · [email protected]https://github.com/dnnsoftware/Dnn.Platform/commit/72f30f69fd2214d77f6c2577dfcca495a24caf5c · [email protected]https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-wq2j-w9pm-7x2p · [email protected]
EPSS history
Timeline
  • 22 SEP 20:59Z
    DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters
    cvelistv5