CVE-2026-40321 | High | 8.0 | 2026-04-17 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a sp… |
CVE-2026-40306 | Medium | 6.5 | 2026-04-17 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have… |
CVE-2026-40305 | Medium | 4.3 | 2026-04-17 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10… |
CVE-2020-37103 | Medium | 6.4 | 2026-02-03 | DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through… |
CVE-2026-24838 | Critical | 9.1 | 2026-01-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module tit… |
CVE-2026-24837 | High | 7.6 | 2026-01-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9… |
CVE-2026-24836 | High | 7.6 | 2026-01-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9… |
CVE-2026-24833 | High | 7.6 | 2026-01-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module co… |
CVE-2026-24784 | Medium | 6.8 | 2026-01-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9… |
CVE-2025-64095 | Critical | 10.0 | 2025-10-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider… |
CVE-2025-64094 | Medium | 6.4 | 2025-10-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of… |
CVE-2025-62802 | Medium | 4.3 | 2025-10-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HT… |
CVE-2025-59821 | Medium | 6.5 | 2025-09-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling… |
CVE-2025-59548 | Medium | 6.1 | 2025-09-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, specially crafted URLs t… |
CVE-2025-59547 | Medium | 5.3 | 2025-09-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the CKEditor file upload… |
CVE-2025-59546 | Low | 2.4 | 2025-09-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, administrators and conte… |
CVE-2025-59545 | Critical | 9.0 | 2025-09-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the Prompt module allows… |
CVE-2025-59539 | Medium | 6.3 | 2025-09-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding informati… |
CVE-2025-59535 | Medium | 6.5 | 2025-09-22 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be… |
CVE-2025-52488 | High | 8.6 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-52487 | High | 7.5 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 7.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-52486 | Medium | 6.1 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-52485 | Medium | 5.4 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-48378 | Medium | 5.4 | 2025-05-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could… |
CVE-2025-48377 | Medium | 5.4 | 2025-05-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a specially crafted URL… |
CVE-2025-48376 | Low | 3.5 | 2025-05-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a malicious SuperUser (H… |
CVE-2025-32374 | Medium | 5.9 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Possible denial of service with specially crafted… |
CVE-2025-32373 | Medium | 6.5 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In limited configurations, registered users may b… |
CVE-2025-32372 | Medium | 6.5 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously k… |
CVE-2025-32371 | Medium | 4.3 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to… |
CVE-2025-32036 | Medium | 4.2 | 2025-04-08 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. The algorithm used to generate the captcha image… |
CVE-2025-32035 | Low | 2.6 | 2025-04-08 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when… |
CVE-2022-47053 | Medium | 5.4 | 2023-04-12 | An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code… |
CVE-2022-2922 | Medium | 4.9 | 2022-09-30 | Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0. |
CVE-2021-31858 | Medium | 5.4 | 2022-07-20 | DotNetNuke (DNN) 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated… |
CVE-2021-40186 | Medium | 6.5 | 2022-06-02 | The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulner… |
CVE-2020-11585 | Medium | 4.3 | 2020-04-06 | There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A register… |
CVE-2020-5188 | Medium | 6.5 | 2020-02-24 | DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions. |
CVE-2020-5187 | High | 8.8 | 2020-02-24 | DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2). |
CVE-2020-5186 | Medium | 5.4 | 2020-02-24 | DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2). |
CVE-2019-12562 | Medium | 6.1 | 2019-09-26 | Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notificatio… |
CVE-2018-18326 | High | 7.5 | 2019-07-03 | DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists bec… |
CVE-2018-18325 | High | 7.5 | 2019-07-03 | DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for C… |
CVE-2018-15812 | High | 7.5 | 2019-07-03 | DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy. |
CVE-2018-15811 | High | 7.5 | 2019-07-03 | DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters. |
CVE-2018-14486 | Medium | 6.1 | 2019-03-21 | DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML. |
CVE-2017-0929 | High | 7.5 | 2018-07-03 | DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access… |
CVE-2017-9822 | High | 8.8 | 2017-07-20 | DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites." |
CVE-2015-2794 | Critical | 9.8 | 2017-02-06 | The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to… |
CVE-2016-7119 | Medium | 5.4 | 2016-08-31 | Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arb… |
CVE-2015-1566 | | | 2015-02-09 | Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vector… |
CVE-2013-7335 | | | 2014-03-12 | Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct… |
CVE-2013-4649 | | | 2014-03-12 | Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML v… |
CVE-2013-3943 | | | 2014-03-12 | Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script… |
CVE-2012-1036 | | | 2012-04-11 | Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary… |
CVE-2012-1030 | | | 2012-04-11 | Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a cra… |
CVE-2010-4514 | | | 2010-12-09 | Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script… |
CVE-2009-4110 | | | 2009-11-29 | Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or… |
CVE-2009-4109 | | | 2009-11-29 | The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing functionality related to determination of the need for an up… |
CVE-2008-7102 | | | 2009-08-27 | DotNetNuke 2.0 through 4.8.4 allows remote attackers to load .ascx files instead of skin files, and possibly access privileged functionality, via unknown vecto… |
CVE-2008-7101 | | | 2009-08-27 | Unspecified vulnerability in DotNetNuke 4.0 through 4.8.4 and 5.0 allows remote attackers to obtain sensitive information (portal number) by accessing the inst… |
CVE-2008-7100 | | | 2009-08-27 | Unspecified vulnerability in DotNetNuke 4.4.1 through 4.8.4 allows remote authenticated users to bypass authentication and gain privileges via unknown vectors… |
CVE-2009-1366 | | | 2009-04-22 | Cross-site scripting (XSS) vulnerability in Website\admin\Sales\paypalipn.aspx in DotNetNuke (DNN) before 4.9.3 allows remote attackers to inject arbitrary web… |
CVE-2008-6733 | | | 2009-04-21 | Cross-site scripting (XSS) vulnerability in the error handling page in DotNetNuke 4.6.2 through 4.8.3 allows remote attackers to inject arbitrary web script or… |
CVE-2008-6732 | | | 2009-04-21 | Cross-site scripting (XSS) vulnerability in the Language skin object in DotNetNuke before 4.8.4 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2008-6644 | | | 2009-04-07 | Cross-site scripting (XSS) vulnerability in Default.aspx in DotNetNuke 4.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the… |
CVE-2008-6542 | | | 2009-03-30 | Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of applic… |
CVE-2008-6541 | | | 2009-03-30 | Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrary files and gain pr… |
CVE-2008-6540 | | | 2009-03-30 | DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot… |
CVE-2008-6399 | | | 2009-03-05 | Unspecified vulnerability in DotNetNuke 4.5.2 through 4.9 allows remote attackers to "add additional roles to their user account" via unknown attack vectors. |
CVE-2006-4973 | | | 2006-09-25 | Cross-site scripting (XSS) vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3.5, allows remote a… |
CVE-2006-3601 | | | 2006-07-18 | ** UNVERIFIABLE ** Unspecified vulnerability in an unspecified DNN Modules module for DotNetNuke (.net nuke) allows remote attackers to gain privileges via un… |
CVE-2005-0040 | | | 2005-05-19 | Multiple cross-site scripting (XSS) vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) regis… |
CVE-2004-2325 | | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in EditModule.aspx for DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to inject… |
CVE-2004-2324 | | | 2004-12-31 | SQL injection vulnerability in DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to modify the backend database via the (1)… |
CVE-2004-2323 | | | 2004-12-31 | DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information, including the SQL server username and pas… |