CVE-2025-59821
Description
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. In these cases, the application does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim’s browser to interpret attacker-controlled content as part of the page’s HTML. This issue has been patched in version 10.1.0.
How to fix
- dnnsoftware dotnetnuke10.1.0 or later
- DotNetNuke.Core10.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dnnsoftware dotnetnuke | v < 10.1.0 | 10.1.0 |
| DotNetNuke.CoreNuGet | v < 10.1.0 | 10.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.