Dotnetnuke vulnerabilities | LiveThreat CVE Feed

Product

Dotnetnuke

by Dnnsoftware · last CVE Apr 17, 2026

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities76 In the news0 Timeline

Severity mix

Critical 3High 14Medium 32Low 1

Severity

All severities76 Critical3 High14 Medium32 Low1

Exploitation

On CISA KEV3 Exploited in the wild3

Watch

Add Dotnetnuke to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2017-9822 RansomwareIn wildKEV	8.8	95%	Jul 20	DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites." Affected: before 9.1.1
CVE-2018-18325 In wildKEV	7.5	74%	Jul 3	DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability Affected: 9.2 through 9.2.2
CVE-2018-15811 In wildKEV	7.5	76%	Jul 3	DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters Affected: 9.2 through 9.2.1
CVE-2020-5187	8.8	2%	Feb 24	DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2) Affected: through 9.4.4
CVE-2025-52488	8.6	36%	Jun 21	DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: 6.0.0 before 10.0.1
CVE-2026-40321	8.0	6%	Apr 17	DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload Affected: before 10.2.2
CVE-2025-52487	7.5	0%	Jun 21	DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: 7.0.0 before 10.0.1
CVE-2025-32374	7.5	0%	Apr 9	DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 9.13.8
CVE-2025-32372	7.5	0%	Apr 9	DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 9.13.8
CVE-2025-32035	7.5	0%	Apr 8	DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem Affected: before 9.13.2
CVE-2021-40186	7.5	1%	Jun 2	The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke Affected: through 9.10.2
CVE-2018-18326	7.5	54%	Jul 3	DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy Affected: 9.2 through 9.2.2
CVE-2018-15812	7.5	47%	Jul 3	DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy Affected: 9.2 through 9.2.1
CVE-2017-0929	7.5	13%	Jul 3	DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class Affected: before 9.2.0