Critical · published September 23, 2025
🚨 A single attack could pull off script execution through the Prompt module in DNN, and it’s as easy as sending a crafted command! 🔥 Think of it like a chef in a restaurant accepting an order without checking the ingredients list. If a sneaky customer slips in a forbidden item, it could spice up the dish in a disastrous way! An attacker could exploit this vulnerability to execute malicious scripts, potentially hijacking user sessions or defacing webpages. The consequences could be absolutely devastating, allowing complete control of your site and putting user data at risk!
Think of it like a chef in a restaurant accepting an order without checking the ingredients list. If a sneaky customer slips in a forbidden item, it could spice up the dish in a disastrous way! The vulnerability in DNN allows malicious input to be processed via the Prompt module, leading to XSS execution even if the input is sanitized for other contexts. This means that raw HTML commands can be executed, bypassing security measures intended to keep users safe.
An attacker could exploit this vulnerability to execute malicious scripts, potentially hijacking user sessions or defacing webpages. The consequences could be absolutely devastating, allowing complete control of your site and putting user data at risk! Upgrade to DNN version 10.1.0 immediately to patch this critical vulnerability. Conduct a review of any custom modules that interact with the Prompt function to ensure they do not introduce similar risks. Regular security audits are highly recommended for ongoing protection! You’ve got this! With these steps, you’re on your way to securing your DNN installation! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| dnnsoftware/dotnetnuke | < 10.1.0 | 10.1.0 |