CVE-2025-64094: medium-severity vulnerability in dnnsoftware Dnn.Platform
DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.4epss 0.2%
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios. This vulnerability exists because of an incomplete fix for CVE-2025-48378. This vulnerability is fixed in 10.1.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
dnnsoftware · Dnn.PlatformRelated CVEs — dnnsoftware Dnn.Platform
In the same product, most dangerous first.
CVE-2025-64095CRITICALDNN Insufficient Access Control - Image Upload allows for Site Content OverwriteEPSS 47.0%CVE-2025-52488HIGHDNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user inputEPSS 35.8%CVE-2026-40321HIGHDotNetNuke.Core has stored cross-site-scripting (XSS) via SVG uploadEPSS 6.4%CVE-2025-59545CRITICALDNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt moduleEPSS 0.5%CVE-2025-59535MEDIUMDotNetNuke.Core allows loading of unused themes on anonymous clients through query parametersEPSS 0.4%CVE-2025-32374MEDIUMPossible Denial of Service (DoS) in DNN.PLATFORM registrationEPSS 0.4%