Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2025-52485

DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue has been patched in version 10.0.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

dnnsoftware Dnn.Platform

  • >= 6.0.0, < 10.0.1affected

References