CVE-2025-48376

2.4 lowEPSS 0.3%

Low (2.4) in dnnsoftware dotnetnuke. EPSS 0.3% chance of exploitation in the next 30 days.

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a malicious SuperUser (Host) could craft a request to use an external url for a site export to then be imported. Version 9.13.9 fixes the issue.

Severity

CVSS 3.1

2.4 low

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-841
Published: 2025-05-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dnnsoftware:dotnetnuke

References

https://github.com/dnnsoftware/Dnn.Platform/commit/13fb13ee76173c3467d7ee8d120b20ca7bd4fa63
https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-62mf-vhhw-xmf8

Check your stack JSON