DNNSoftware vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 202523
3. 20269

Newest CVEs

• CVE-2026-40321

  DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload

  dnnsoftware · Dnn.Platform

  High8.1
• CVE-2026-40306

  DNN has same HostGUID for all new installs

  dnnsoftware · Dnn.Platform

  Medium6.9
• CVE-2026-40305

  DNN has Force Friend Request Acceptance

  dnnsoftware · Dnn.Platform

  Medium4.3
• CVE-2020-37103

  DotNetNuke 9.5 - Persistent Cross-Site Scripting

  Dnnsoftware · DotNetNuke

  Medium5.1
• CVE-2026-24838

  DotNetNuke.Core Vulnerable to Stored XSS via Module Title

  dnnsoftware · Dnn.Platform

  Critical9.1
• CVE-2026-24837

  DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

  dnnsoftware · Dnn.Platform

  High7.7
• CVE-2026-24836

  DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

  dnnsoftware · Dnn.Platform

  High7.7
• CVE-2026-24833

  DotNetNuke.Core Vulnerable to Stored XSS in Module Description

  dnnsoftware · Dnn.Platform

  High7.7
• CVE-2026-24784

  DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer

  dnnsoftware · Dnn.Platform

  Medium6.8
• CVE-2025-64095

  DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

  dnnsoftware · Dnn.Platform

  Critical10.0