CVE-2025-59548CWE-79cross-site-scripting

CVE-2025-59548

Medium · published September 23, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
8.0
In the wild
Unconfirmed
What it is

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, specially crafted URLs to the FileBrowser are vulnerable to javascript injection, affecting any unsuspecting user clicking such link. This issue has been patched in version 10.1.0.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00188 · 8.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-09-23T22:15Z
Affected products (1)
ProductVersionsFixed in
dnnsoftware/dotnetnuke< 10.1.010.1.0
References (1)
https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-5fj9-542v-w4rq · [email protected]
EPSS history
Timeline
  • 23 SEP 17:58Z
    DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser
    cvelistv5