CVE-2020-37103

DotNetNuke 9.5 - Persistent Cross-Site Scripting

Medium5.1Public exploitEPSS 0.36%

Published: 3 Feb 2026
Updated: 14 May 2026
Reserved: 1 Feb 2026
Assigned by: VulnCheck

Description

DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system.

ExploitDB-48124 (opens in a new tab)exploit

Timeline

2026
1 Feb 2026
1 Feb 2026
ID reserved
By VulnCheck
3 Feb 20262 days later
3 Feb 2026· 2 days later
Published
14 May 20263 months later
14 May 2026· 3 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2020-37103, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
VulnCheckCNA (assigner)	3.1	Medium6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVDNVD · Analyzed	4.0	Medium5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.36% · top 71% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.

Weakness

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

Dnnsoftware · DotNetNuke
- affected ≤ 9.5

References (4)

ExploitDB-48124 (opens in a new tab)exploit
DotNetNuke Official Vendor Homepage (opens in a new tab)product
Vulnerability Analysis Blog Post (opens in a new tab)technical-description
VulnCheck Advisory: DotNetNuke 9.5 - Persistent Cross-Site Scripting (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-37103](https://trackcve.app/badge/CVE-2020-37103.svg)](https://trackcve.app/cve/CVE-2020-37103)

Record last updated 14 May 2026, 02:06 UTC.