Skip to content
OpenAdvisories

Package · NuGet

DotNetNuke.Core

36 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 8.1
    CVE-2026-40321

    DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload

    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthent…

    dnnsoftware Dnn.Platform DotNetNuke.Core NuGet
  • High 7.7
    CVE-2026-24837

    DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a module friendly name could include scripts that will run during some module ope…

    dnnsoftware Dnn.Platform DotNetNuke.Core NuGet
  • High 7.7
    CVE-2026-24836

    DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would…

    dnnsoftware Dnn.Platform DotNetNuke.Core NuGet
  • High 8.8
    CVE-2020-5187

    DNN Path Traversal via Zip Slip

    DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).

    DotNetNuke.Core NuGet
  • High 7.5
    CVE-2018-18326 Public exploit EPSS 54%

    Insufficient Entropy in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.

    DotNetNuke.Core NuGet
  • High 7.5
    CVE-2018-18325 Exploited Public exploit EPSS 74%

    Inadequate Encryption Strength in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

    DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-15812 Public exploit EPSS 47%

    Insufficient Entropy in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.

    DotNetNuke.Core NuGet
  • High 7.5
    CVE-2018-15811 Exploited Public exploit EPSS 76%

    Inadequate Encryption Strength in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

    DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • High 7.5
    CVE-2017-0929 EPSS 13%

    High severity vulnerability that affects DotNetNuke.Core

    DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.

    DotNetNuke.Core NuGet
  • High 8.8
    CVE-2017-9822 Exploited · Ransomware Public exploit EPSS 95%

    DNN (aka DotNetNuke) has Remote Code Execution via a cookie

    DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

    DotNetNuke DotNetNuke CMS Fixed in 9.1.1 DotNetNuke.Core NuGet
    KEV Nov 3, 2021