CVE-2025-48378
Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline
- State
- Published
- Severity
- 6.1 Medium
- Published
- May 23, 2025
- Updated
- May 23, 2025
- Reserved
- May 19, 2025
Description
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N | GitHub_M |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Dnn.Platformdnnsoftware |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.