Reflected Cross-Site Scripting (XSS) in module actions in edit mode

中危 5.4CVE-2025-48377 · GHSA-79m3-rvx2-3qq9 · Published 23/05/2025 · updated 17/06/2026

要点

CVE-2025-48377 是影响 DotNetNuke.Core, DotNetNuke.Web, dotnetnuke (dnnsoftware) 的中危 (CVSS 5.4)漏洞。
未来 30 天内被利用的概率（EPSS）：0.24%，高于 15.0% 的漏洞。
修复：升级到 9.13.9 或更高版本。

Package	Affected versions	Patched versions
DotNetNuke.Core NuGet	`< 9.13.9`	`9.13.9`
DotNetNuke.Web NuGet	`< 9.13.9`	`9.13.9`
dotnetnuke dnnsoftware	`< 9.13.9`	`9.13.9`

Description

A specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions.

NVD description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions. Version 9.13.9 fixes the issue.

References

dnnsoftware/Dnn.Platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-48377 · ADVISORY
dnnsoftware/Dnn.Platform commit 351b166 · WEB
dnnsoftware/Dnn.Platform · PACKAGE

DotNetNuke.Core 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

DotNetNuke.Core

NuGet

< 9.13.9

9.13.9

DotNetNuke.Web

NuGet

< 9.13.9

9.13.9

dotnetnuke

dnnsoftware

< 9.13.9

9.13.9

Description

A specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions.

NVD description

DotNetNuke.Core 的其他漏洞

查看全部 →