Dotnetnuke vulnerabilities
11 known vulnerabilities in Dotnetnuke from Dnnsoftware. 11 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.0 High severity
Dnn.Platform: Improper Neutralization of Alternate XSS Syntax
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenti
- 9.8 Critical severity
Dnn.Platform: Unrestricted Upload of File with Dangerous Type
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user
- 9.0 Critical severity
Dnn.Platform: Improper Neutralization of Input During Web Page Generation
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsew
- 8.6 High severity
Dnn.Platform: Exposure of Sensitive Information to an Unauthorized Actor
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a thi
- 7.5 High severity
Dnn.Platform: Incorrect Authorization
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 7.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request or proxy to be created that could bypass the design of DNN Login I
- 7.5 High severity
Dnn.Platform: Allocation of Resources Without Limits or Throttling
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Possible denial of service with specially crafted information in the public registration form. This vulnerability is fixed in 9.13.8.
- 7.5 High severity
Dnn.Platform: Server-Side Request Forgery
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET request
- 7.5 High severity
Dnn.Platform: Insufficient Type Distinction
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when uploading assets), the file extension is checked to see if it's an allowed file type but the actual c
- 7.5 High severity
DotNetNuke (DNN) Inadequate Encryption Strength Exploited
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
- 7.5 High severity
DotNetNuke (DNN) Inadequate Encryption Strength Exploited
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
- 8.8 High severity
DotNetNuke (DNN) Remote Code Execution Exploited
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."