DotNetNuke.Core (nuget) security advisories

HIGH 8.0

NuGet

CVE-2026-40321

DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload

Apr 10, 2026

MEDIUM 4.3

NuGet

CVE-2026-40305

DNN: Force Friend Request Acceptance

Apr 10, 2026

MEDIUM 6.5

NuGet

CVE-2026-40306

DNN: Same HostGUID for all new installs

Apr 10, 2026

UNKNOWN

NuGet

GHSA-fcpv-w245-r2q7

DotNetNuke.Core security code analysis rules triggered

Apr 14, 2026

MEDIUM 6.9

NuGet

CVE-2026-24784

DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer

Jan 28, 2026

HIGH 7.6

NuGet

CVE-2026-24836

DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

Jan 28, 2026

HIGH 7.6

NuGet

CVE-2026-24837

DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

Jan 28, 2026

CRITICAL 9.1

NuGet

CVE-2026-24838

DotNetNuke.Core Vulnerable to Stored XSS via Module Title

Jan 28, 2026

MEDIUM 6.4

NuGet

CVE-2025-64094

DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

Oct 29, 2025

HIGH 7.5

NuGet KEV

CVE-2018-15811

Inadequate Encryption Strength in DotNetNuke

Jul 5, 2019

HIGH 7.5

NuGet KEV

CVE-2018-18325

Inadequate Encryption Strength in DotNetNuke

Jul 5, 2019

LOW 2.4

NuGet

CVE-2025-59546

DNN Vulnerable to Stored XSS Using Backend Admin Credentials

Sep 23, 2025

MEDIUM 6.5

NuGet

CVE-2025-59821

DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile

Sep 23, 2025

MEDIUM 6.3

NuGet

CVE-2025-59539

DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

Sep 22, 2025

CRITICAL 9.0

NuGet

CVE-2025-59545

DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module

Sep 23, 2025

MEDIUM 6.5

NuGet

CVE-2025-59535

DNN allows loading unused themes on anonymous clients through query parameters

Sep 22, 2025

UNKNOWN

NuGet

CVE-2025-48378

DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline

May 23, 2025

UNKNOWN

NuGet

CVE-2025-48377

Reflected Cross-Site Scripting (XSS) in module actions in edit mode

May 23, 2025

MEDIUM 6.5

NuGet

CVE-2025-32372

DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)

Apr 9, 2025

UNKNOWN

NuGet

CVE-2013-4649

DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter

May 17, 2022

CRITICAL 9.8

NuGet

CVE-2015-2794

The installation wizard in DotNetNuke (DNN) allows privilege escalation

Oct 16, 2018

UNKNOWN

NuGet

CVE-2015-1566

Moderate severity vulnerability that affects DotNetNuke.Core

Oct 16, 2018

MEDIUM 6.1

NuGet

CVE-2019-12562

Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke

Nov 18, 2019

MEDIUM 5.4

NuGet

CVE-2020-5186

DNN XSS Vulnerability

May 24, 2022

HIGH 8.8

NuGet

CVE-2020-5187

DNN Path Traversal via Zip Slip

May 24, 2022

MEDIUM 6.1

NuGet

CVE-2018-14486

DNN XSS Vulnerability

May 14, 2022

MEDIUM 4.0

NuGet

CVE-2013-7335

DotNetNuke (DNN) Open redirect vulnerability

May 17, 2022

MEDIUM 6.5

NuGet

CVE-2020-5188

DNN File Upload Vulnerability

May 24, 2022

MEDIUM 4.9

NuGet

CVE-2022-2922

DNN vulnerable to Relative Path Traversal

Oct 1, 2022

HIGH 7.5

NuGet

CVE-2018-18326

Insufficient Entropy in DotNetNuke

Jul 5, 2019

HIGH 7.5

NuGet

CVE-2018-15812

Insufficient Entropy in DotNetNuke

Jul 5, 2019

HIGH 8.8

NuGet KEV

CVE-2017-9822

DNN (aka DotNetNuke) has Remote Code Execution via a cookie

Oct 16, 2018

HIGH 7.5

NuGet

CVE-2017-0929

High severity vulnerability that affects DotNetNuke.Core

Oct 16, 2018

MEDIUM 5.4

NuGet

CVE-2016-7119

Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN)

Oct 16, 2018

UNKNOWN

NuGet

CVE-2008-6540

DotNetNuke Default Machine Key Exposure

May 14, 2022

UNKNOWN

NuGet

CVE-2007-0660

DotNetNuke Vulnerable to XSS in Pass-Through Values

May 1, 2022

DotNetNuke.Core

Vulnerabilities

DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload

DNN: Force Friend Request Acceptance

DNN: Same HostGUID for all new installs

DotNetNuke.Core security code analysis rules triggered

DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer

DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

DotNetNuke.Core Vulnerable to Stored XSS via Module Title

DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

Inadequate Encryption Strength in DotNetNuke

Inadequate Encryption Strength in DotNetNuke

DNN Vulnerable to Stored XSS Using Backend Admin Credentials

DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile

DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module

DNN allows loading unused themes on anonymous clients through query parameters

DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline

Reflected Cross-Site Scripting (XSS) in module actions in edit mode

DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)

DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter

The installation wizard in DotNetNuke (DNN) allows privilege escalation

Moderate severity vulnerability that affects DotNetNuke.Core

Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke

DNN XSS Vulnerability

DNN Path Traversal via Zip Slip

DNN XSS Vulnerability

DotNetNuke (DNN) Open redirect vulnerability

DNN File Upload Vulnerability

DNN vulnerable to Relative Path Traversal

Insufficient Entropy in DotNetNuke

Insufficient Entropy in DotNetNuke

DNN (aka DotNetNuke) has Remote Code Execution via a cookie

High severity vulnerability that affects DotNetNuke.Core

Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN)

DotNetNuke Default Machine Key Exposure

DotNetNuke Vulnerable to XSS in Pass-Through Values

Start Securing