CVE-2025-48378

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.

Risk Information

Base Score

5.4

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.018

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-48378,CVE-2025-48377 are fixed in Nuget - DotNetNuke.Core 9.13.9	Windows
Vulnerabilities CVE-2025-48378,CVE-2025-48377 are fixed in Nuget - DotNetNuke.Core for Linux 9.13.9	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234