DO
Product
DotNetNuke
On CISA KEVExploited in the wildRansomware-linked
76
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 14Medium 32Low 1
Watch
Add DotNetNuke to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-1566 | – | Feb 9 | Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 07.03.04 |
| CVE-2013-7335 | – | Mar 12 | Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via… Affected: through 6.2.8; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10d; +34 more |
| CVE-2013-4649 | – | Mar 12 | Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable… Affected: through 6.2.8; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10d; +34 more |
| CVE-2013-3943 | – | Mar 12 | Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors… Affected: through 6.2.8; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10d; +34 more |
| CVE-2012-1036 | – | Apr 11 | Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML… Affected: through 5.6.3; 4.9.1; 4.9.2; 5.1.1; 5.1.2; 5.1.3; +4 more |
| CVE-2012-1030 | – | Apr 11 | Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing… Affected: 6.0.0; 6.0.1; 6.0.2 |
| CVE-2010-4514 | – | Dec 9 | Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the… Affected: 5.05.01; 5.06.00 |
| CVE-2009-4110 | – | Nov 29 | Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search… Affected: 4.8.0; 4.8.1; 4.8.2; 4.8.3; 4.8.4; 4.9; +8 more |
| CVE-2009-4109 | – | Nov 29 | The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing functionality related to determination of the need for an upgrade, which allows… Affected: 4.0; 4.3.5; 4.4.1; 4.5.2; 4.5.4; 4.5.5; +18 more |
| CVE-2008-7102 | – | Aug 27 | DotNetNuke 2.0 through 4.8.4 allows remote attackers to load .ascx files instead of skin files, and possibly access privileged functionality, via unknown vectors related to… Affected: 2.1.1; 2.1.2; 3.0.7; 3.0.8; 3.0.11; 3.1.0; +16 more |
| CVE-2008-7101 | – | Aug 27 | Unspecified vulnerability in DotNetNuke 4.0 through 4.8.4 and 5.0 allows remote attackers to obtain sensitive information (portal number) by accessing the install wizard page via… Affected: 4.0; 4.3.5; 4.4.1; 4.5.2; 4.5.4; 4.5.5; +10 more |
| CVE-2008-7100 | – | Aug 27 | Unspecified vulnerability in DotNetNuke 4.4.1 through 4.8.4 allows remote authenticated users to bypass authentication and gain privileges via unknown vectors related to a "unique… Affected: 4.4.1; 4.5.2; 4.5.4; 4.5.5; 4.6.0; 4.6.1; +7 more |
| CVE-2009-1366 | – | Apr 22 | Cross-site scripting (XSS) vulnerability in Website\admin\Sales\paypalipn.aspx in DotNetNuke (DNN) before 4.9.3 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 4.9.2; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10d; +24 more |
| CVE-2008-6733 | – | Apr 21 | Cross-site scripting (XSS) vulnerability in the error handling page in DotNetNuke 4.6.2 through 4.8.3 allows remote attackers to inject arbitrary web script or HTML via the… Affected: 4.6.2; 4.8.1; 4.8.2; 4.8.3 |
| CVE-2008-6732 | – | Apr 21 | Cross-site scripting (XSS) vulnerability in the Language skin object in DotNetNuke before 4.8.4 allows remote attackers to inject arbitrary web script or HTML via "newly generated… Affected: through 4.8.3; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10d; +20 more |
| CVE-2008-6644 | – | Apr 7 | Cross-site scripting (XSS) vulnerability in Default.aspx in DotNetNuke 4.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO Affected: through 4.8.3; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10d; +13 more |
| CVE-2008-6542 | – | Mar 30 | Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by… Affected: through 4.8.1; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10d; +9 more |
| CVE-2008-6541 | – | Mar 30 | Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrary files and gain privileges to the… Affected: through 4.8.1; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10d; +11 more |
| CVE-2008-6540 | – | Mar 30 | DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the… Affected: through 4.8.1; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10d; +11 more |
| CVE-2008-6399 | – | Mar 5 | Unspecified vulnerability in DotNetNuke 4.5.2 through 4.9 allows remote attackers to "add additional roles to their user account" via unknown attack vectors Affected: 4.5.2; 4.8.1; 4.8.2; 4.8.3; 4.8.4; 4.9 |
| CVE-2006-4973 | – | Sep 25 | Cross-site scripting (XSS) vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3.5, allows remote attackers to inject… Affected: 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10d; 1.0.10e; +6 more |
| CVE-2006-3601 | – | Jul 18 | ** UNVERIFIABLE ** Unspecified vulnerability in an unspecified DNN Modules module for DotNetNuke (.net nuke) allows remote attackers to gain privileges via unspecified vectors,… Affected: All versions, or not specified |
| CVE-2005-0040 | – | May 19 | Multiple cross-site scripting (XSS) vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) register a new user page,… Affected: through 3.0.11 |
| CVE-2004-2323 | – | Dec 31 | DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information, including the SQL server username and password, via a GET… Affected: 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10d |
| CVE-2004-2324 | – | Dec 31 | SQL injection vulnerability in DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to modify the backend database via the (1) table and (2) field… Affected: 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10d |
| CVE-2004-2325 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in EditModule.aspx for DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to inject arbitrary web script… Affected: 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10d |