CVE-2025-48378: fallo de gravedad media en dnnsoftware Dnn.Platform
Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.3%
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Productos afectados
dnnsoftware · Dnn.PlatformCVEs relacionadas — dnnsoftware Dnn.Platform
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-64095CRITICALDNN Insufficient Access Control - Image Upload allows for Site Content OverwriteEPSS 47.0%CVE-2025-52488HIGHDNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user inputEPSS 35.8%CVE-2026-40321HIGHDotNetNuke.Core has stored cross-site-scripting (XSS) via SVG uploadEPSS 6.4%CVE-2025-59545CRITICALDNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt moduleEPSS 0.5%CVE-2025-59535MEDIUMDotNetNuke.Core allows loading of unused themes on anonymous clients through query parametersEPSS 0.4%CVE-2025-32374MEDIUMPossible Denial of Service (DoS) in DNN.PLATFORM registrationEPSS 0.4%