CVE-2025-52485

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue has been patched in version 10.0.1.

Risk Information

Base Score

5.4

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.05

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-52488,CVE-2025-52485,CVE-2025-52486 are fixed in Nuget - DNN.PLATFORM 10.0.1	Windows
Vulnerabilities CVE-2025-52488,CVE-2025-52485,CVE-2025-52486 are fixed in Nuget - DNN.PLATFORM for Linux 10.0.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234