CVE-2020-37103
DotNetNuke 9.5 - Persistent Cross-Site Scripting
- State
- Published
- Severity
- 5.1 Medium
- Published
- Feb 3, 2026
- Updated
- May 14, 2026
- Reserved
- Feb 1, 2026
Description
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
DotNetNukeDnnsoftware |
|
References
- ExploitDB-48124exploit
- DotNetNuke Official Vendor Homepageproduct
- Vulnerability Analysis Blog Posttechnical-description
- VulnCheck Advisory: DotNetNuke 9.5 - Persistent Cross-Site Scriptingthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.