CVE-2025-48377

6.0 mediumEPSS 0.2%

Medium (6.0) in dnnsoftware dotnetnuke. EPSS 0.2% chance of exploitation in the next 30 days.

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions. Version 9.13.9 fixes the issue.

Severity

CVSS 4.0

6.0 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-05-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dnnsoftware:dotnetnuke

References

https://github.com/dnnsoftware/Dnn.Platform/commit/351b166492ad4b6509c273dc83211d52238e31a7
https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-79m3-rvx2-3qq9

Check your stack JSON