medium6.1
CVE-2025-52486
DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects
Impact
DNN.PLATFORM allows specially crafted content in URLs could be used with TokenReplace and not be properly sanitized by some SkinObjects. This vulnerability is fixed in 10.0.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | DNN.PLATFORM | >= 6.0.0, < 10.0.1 | 10.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dnnsoftware | Dotnetnuke | from 6.0.0 before 10.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/dnnsoftware/Dnn.Platform/commit/74f6de68da1572c1d7e9c6e30e9f77f7c5596b1b
- https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-pf4h-vrv6-cmvr
- https://github.com/advisories/GHSA-pf4h-vrv6-cmvr
- https://nvd.nist.gov/vuln/detail/CVE-2025-52486