CVE-2025-48377 MEDIUM

CVE-2025-48377: Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode

Vendor Dnnsoftware
Product Dnn.Platform
Weakness CWE-79 · XSS
Published May 23, 2025
Last update May 23, 2025
View on NVD All CVEs

CVSS base score

6.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

What the vulnerability does

01Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions. Version 9.13.9 fixes the issue.

Key dates

02Disclosure timeline

May 23, 2025 CVE published
May 23, 2025 Record updated