CVE-2025-64094CWE-79cross-site-scripting

CVE-2025-64094

Medium · published October 29, 2025

CVSS v3.1
6.4
EPSS
0%
Percentile
8.7
In the wild
Unconfirmed
What it is

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios. This vulnerability exists because of an incomplete fix for CVE-2025-48378. This vulnerability is fixed in 10.1.1.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00195 · 8.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-29T02:15Z
Affected products (1)
ProductVersionsFixed in
dnnsoftware/dotnetnuke< 10.1.110.1.1
References (1)
https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-hmvq-8p83-cq52 · [email protected]
EPSS history
Timeline
  • 28 OCT 21:44Z
    DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload
    cvelistv5