DO
Product
DotNetNuke
On CISA KEVExploited in the wildRansomware-linked
76
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 14Medium 32Low 1
Watch
Add DotNetNuke to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-9822 RansomwareIn wildKEV | 8.8 | Jul 20 | DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites." Affected: before 9.1.1 |
| CVE-2018-18325 In wildKEV | 7.5 | Jul 3 | DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability Affected: 9.2 through 9.2.2 |
| CVE-2018-15811 In wildKEV | 7.5 | Jul 3 | DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters Affected: 9.2 through 9.2.1 |
| CVE-2025-64095 | 9.8 | Oct 28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 10.1.1 |
| CVE-2015-2794 | 9.8 | Feb 6 | The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to… Affected: through 07.04.00 |
| CVE-2025-59545 | 9.0 | Sep 23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 10.1.0 |
| CVE-2020-5187 | 8.8 | Feb 24 | DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2) Affected: through 9.4.4 |
| CVE-2025-52488 | 8.6 | Jun 21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: 6.0.0 before 10.0.1 |
| CVE-2026-40321 | 8.0 | Apr 17 | DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload Affected: before 10.2.2 |
| CVE-2025-52487 | 7.5 | Jun 21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: 7.0.0 before 10.0.1 |
| CVE-2025-32374 | 7.5 | Apr 9 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 9.13.8 |
| CVE-2025-32372 | 7.5 | Apr 9 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 9.13.8 |
| CVE-2025-32035 | 7.5 | Apr 8 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 9.13.2 |
| CVE-2021-40186 | 7.5 | Jun 2 | The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke Affected: through 9.10.2 |
| CVE-2018-18326 | 7.5 | Jul 3 | DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy Affected: 9.2 through 9.2.2 |
| CVE-2018-15812 | 7.5 | Jul 3 | DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy Affected: 9.2 through 9.2.1 |
| CVE-2017-0929 | 7.5 | Jul 3 | DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class Affected: before 9.2.0 |
| CVE-2026-40306 | 6.5 | Apr 17 | DNN has same HostGUID for all new installs Affected: 10.0.0 before 10.2.2 |
| CVE-2025-59535 | 6.5 | Sep 22 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 10.1.0 |
| CVE-2025-32373 | 6.5 | Apr 9 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 9.13.8 |
| CVE-2025-32036 | 6.5 | Apr 8 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 9.13.8 |
| CVE-2020-5188 | 6.5 | Feb 24 | DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions Affected: through 9.4.4 |
| CVE-2025-59821 | 6.1 | Sep 23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 10.1.0 |
| CVE-2025-59548 | 6.1 | Sep 23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 10.1.0 |
| CVE-2025-52486 | 6.1 | Jun 21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: 6.0.0 before 10.0.1 |
| CVE-2019-12562 | 6.1 | Sep 26 | Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page Affected: before 9.4.0 |
| CVE-2018-14486 | 6.1 | Mar 17 | DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML Affected: 9.1.1 |
| CVE-2020-37103 | 5.4 | Feb 3 | DotNetNuke 9.5 - Persistent Cross-Site Scripting Affected: through 9.5 |
| CVE-2026-24838 | 5.4 | Jan 27 | DotNetNuke.Core Vulnerable to Stored XSS via Module Title Affected: before 9.13.10; 10.0.0 before 10.2.0 |
| CVE-2026-24837 | 5.4 | Jan 27 | DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal Affected: 9.0.0 before 9.13.10; 10.0.0 before 10.2.0 |
| CVE-2026-24836 | 5.4 | Jan 27 | DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes Affected: 9.0.0 before 9.13.10; 10.0.0 before 10.2.0 |
| CVE-2026-24833 | 5.4 | Jan 27 | DotNetNuke.Core Vulnerable to Stored XSS in Module Description Affected: before 9.13.10; 10.0.0 before 10.2.0 |
| CVE-2025-64094 | 5.4 | Oct 28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 10.1.1 |
| CVE-2025-59539 | 5.4 | Sep 23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 10.1.0; 10.1.0 |
| CVE-2025-52485 | 5.4 | Jun 21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: 6.0.0 before 10.0.1 |
| CVE-2025-48378 | 5.4 | May 23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 9.13.9 |
| CVE-2025-48377 | 5.4 | May 23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 9.13.9 |
| CVE-2022-47053 | 5.4 | Apr 12 | An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG… Affected: 7.0.0 through 9.10.2 |
| CVE-2021-31858 | 5.4 | Jul 20 | DotNetNuke (DNN) 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated users to inject… Affected: through 9.10.2 |
| CVE-2020-5186 | 5.4 | Feb 24 | DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2) Affected: through 9.4.4 |
| CVE-2016-7119 | 5.4 | Aug 31 | Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or… Affected: through 08.00.04 |
| CVE-2025-59547 | 5.3 | Sep 23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 10.1.0 |
| CVE-2022-2922 | 4.9 | Sep 30 | Relative Path Traversal in dnnsoftware/dnn.platform Affected: before 9.11.0 |
| CVE-2026-24784 | 4.8 | Jan 27 | DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer Affected: 9.0.0 before 9.13.10; 10.0.0 before 10.2.0 |
| CVE-2025-59546 | 4.8 | Sep 23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 10.1.0 |
| CVE-2026-40305 | 4.3 | Apr 17 | DNN has Force Friend Request Acceptance Affected: 6.0.0 before 10.2.2 |
| CVE-2025-62802 | 4.3 | Oct 28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 10.1.1 |
| CVE-2025-32371 | 4.3 | Apr 9 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 9.13.4 |
| CVE-2020-11585 | 4.3 | Apr 6 | There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module Affected: 9.5.0 |
| CVE-2025-48376 | 2.4 | May 23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 9.13.9 |