CVE-2025-59546CWE-79cross-site-scripting

CVE-2025-59546

Low · published September 23, 2025

CVSS v3.1
2.4
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, administrators and content editors can set html in module titles that could include javascript which could be used for XSS based attacks. This issue has been patched in version 10.1.0.

The record
Technical detail
CVSS v3.1
2.4 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00183 · 7.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-09-23T22:15Z
Affected products (1)
ProductVersionsFixed in
dnnsoftware/dotnetnuke< 10.1.010.1.0
References (1)
https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-gj8m-5492-q98h · [email protected]
EPSS history
Timeline
  • 23 SEP 17:41Z
    DNN Vulnerable to Stored XSS Using Backend Admin Credentials
    cvelistv5