Product by Dnnsoftware
Dnn.Platform
32 known vulnerabilities in Dnn.Platform (Dnnsoftware), 0 of them actively exploited (CISA KEV).
Key figures
32
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-64095 | DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite | 10.0 | |
| High | CVE-2025-52488 | DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input | 8.6 | |
| High | CVE-2026-40321 | DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload | 8.0 | |
| Critical | CVE-2025-59545 | DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module | 9.1 | |
| High | CVE-2021-40186 | DNN CMS Server-Side Request Forgery (SSRF) | 6.5 | |
| Critical | CVE-2026-24838 | DotNetNuke.Core Vulnerable to Stored XSS via Module Title | 9.1 | |
| High | CVE-2025-52487 | DNN.PLATFORM possibly allows bypass of IP Filters | 7.5 | |
| High | CVE-2026-24837 | DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal | 7.7 | |
| High | CVE-2026-24836 | DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes | 7.7 | |
| Medium | CVE-2025-59535 | DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters | 6.5 | |
| High | CVE-2026-24833 | DotNetNuke.Core Vulnerable to Stored XSS in Module Description | 7.7 | |
| Medium | CVE-2026-40306 | DNN has same HostGUID for all new installs | 6.5 | |
| Medium | CVE-2025-32373 | DNN allows a registered user to enumerate and access files they should not have access to | 6.5 | |
| High | CVE-2025-32372 | Server-Side Request Forgery (SSRF) in DotNetNuke.Core | 6.5 | |
| Medium | CVE-2026-24784 | DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer | 6.8 | |
| High | CVE-2025-32374 | Possible Denial of Service (DoS) in DNN.PLATFORM registration | 5.9 | |
| Medium | CVE-2025-59821 | DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile | 6.5 | |
| Medium | CVE-2025-64094 | DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload | 6.4 | |
| Medium | CVE-2025-48378 | Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline | 5.4 | |
| Medium | CVE-2025-59539 | DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field | 6.3 | |
| Medium | CVE-2025-59548 | DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser | 6.1 | |
| Medium | CVE-2025-52486 | Dnnsoftware Dnn.Platform: Cross-site Scripting | 6.1 | |
| Medium | CVE-2025-48377 | Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode | 5.4 | |
| Medium | CVE-2025-59547 | DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation | 5.3 | |
| Medium | CVE-2026-40305 | DNN has Force Friend Request Acceptance | 4.3 |