GHSA-pf4h-vrv6-cmvr

ghsaUSosv

DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects

view advisory published 2025-06-20Licence: CC-BY-4.0

DNN.PLATFORM allows specially crafted content in URLs could be used with TokenReplace and not be properly sanitized by some SkinObjects. This vulnerability is fixed in 10.0.1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-52486US	medium6.1	0.23% (14th)	—	2025-06-21
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows specially craf…

references

External citations — patches, advisories, analysis.

https://github.com/dnnsoftware/Dnn.PlatformPACKAGE
https://github.com/dnnsoftware/Dnn.Platform/commit/74f6de68da1572c1d7e9c6e30e9f77f7c5596b1bWEB
https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-pf4h-vrv6-cmvrWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-52486ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan