DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline

MOYENNE 5.4CVE-2025-48378 · GHSA-m4hf-fxcg-cp34 · Published 23/05/2025 · updated 17/06/2026

En bref

CVE-2025-48378 est une vulnérabilité MOYENNE (CVSS 5.4) touchant DotNetNuke.Core, dotnetnuke (dnnsoftware).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.29%, plus élevée que 22.2% des vulnérabilités.
Correctif : mettre à jour vers 9.13.9 ou plus récent.

Package	Affected versions	Patched versions
DotNetNuke.Core NuGet	`< 9.13.9`	`9.13.9`
dotnetnuke dnnsoftware	`< 9.13.9`	`9.13.9`

Description

Uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks.

NVD description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.

References

dnnsoftware/Dnn.Platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-48378 · ADVISORY
dnnsoftware/Dnn.Platform commit cfed83c · WEB
dnnsoftware/Dnn.Platform · PACKAGE

Autres vulnérabilités de DotNetNuke.Core

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

DotNetNuke.Core

NuGet

< 9.13.9

9.13.9

dotnetnuke

dnnsoftware

< 9.13.9

9.13.9

Description

Uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks.

NVD description

Autres vulnérabilités de DotNetNuke.Core

Tout voir →