Known vulnerabilities in DotNetNuke

Vendor: DNN
Software: DotNetNuke
Software CPE: cpe:2.3:a:dnn:dotnetnuke:*:*:*:*:*:*:*:*
Total vulnerabilities: 55
Public exploits: 5
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting DotNetNuke DotNetNuke is affected by 55 known vulnerabilities: 7 high, 11 medium, 37 low Critical High Medium Low

Vulnerabilities (55)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU146094 - Missing Authorization
CWE-862 Medium
No
No
10.3.3 28.08.2026 SB2026082864
#VU146093 - Server-Side Request Forgery (SSRF)
CWE-918 Low
No
No
10.3.3 28.08.2026 SB2026082864
#VU146092 - Incorrect Authorization
CWE-863 Low
No
No
10.3.3 28.08.2026 SB2026082864
#VU146091 - Authorization Bypass Through User-Controlled Key
CWE-639 Low
No
No
10.3.3 28.08.2026 SB2026082864
#VU146090 - Incorrect Authorization
CWE-863 Low
No
No
10.3.3 28.08.2026 SB2026082864
#VU146089 - Missing Authorization
CWE-862 Low
No
No
10.3.3 28.08.2026 SB2026082864
#VU146088 - Authorization Bypass Through User-Controlled Key
CWE-639 Medium
No
No
10.3.3 28.08.2026 SB2026082864
#VU146086 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Low
No
No
10.3.3 28.08.2026 SB2026082864
#VU146085 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
10.3.3 28.08.2026 SB2026082864
#VU125828 - Improper Access Control
CVE-2026-40305
CWE-284 Low
No
No
10.2.2 11.04.2026 SB2026041145
#VU125827 - Generation of Predictable Numbers or Identifiers
CVE-2026-40306
CWE-340 Medium
No
No
10.2.2 11.04.2026 SB2026041145
#VU125826 - Improper Neutralization of Alternate XSS Syntax
CVE-2026-40321
CWE-87 Low
No
No
10.2.2 11.04.2026 SB2026041145
#VU122097 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-24838
CWE-79 Low
No
No
9.13.10, 10.2.0 28.01.2026 SB2026012841
#VU122096 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-24837
CWE-79 Low
No
No
9.13.10, 10.2.0 28.01.2026 SB2026012841
#VU122095 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-24836
CWE-79 Low
No
No
9.13.10, 10.2.0 28.01.2026 SB2026012841
#VU122094 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-24833
CWE-79 Low
No
No
9.13.10, 10.2.0 28.01.2026 SB2026012841
#VU122093 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-24784
CWE-79 Low
No
No
9.13.10, 10.2.0 28.01.2026 SB2026012841
#VU117787 - Unrestricted Upload of File with Dangerous Type
CVE-2025-64095
CWE-434 High
Available
No
10.1.1 29.10.2025 SB2025102935
#VU117786 - Unrestricted Upload of File with Dangerous Type
CVE-2025-62802
CWE-434 High
No
No
10.1.1 29.10.2025 SB2025102935
#VU117785 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-64094
CWE-79 Low
No
No
10.1.1 29.10.2025 SB2025102935


Showing elements 1 - 20 out of 55