CVE-2025-59539 MEDIUM

CVE-2025-59539: DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

Vendor Dnnsoftware
Product Dnn.Platform
Weakness CWE-79 · XSS
Published September 23, 2025
Last update September 23, 2025
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0.

Key dates

02Disclosure timeline

September 23, 2025 CVE published
September 23, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-37975 WordPress Variation Swatches for WooCommerce Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS) CVE-2026-27614 Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering CVE-2024-52502 WordPress ImbaChat plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability CVE-2024-27992 WordPress Link Whisper Free plugin <= 0.6.8 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2023-3844 mooSocial mooDating URL friends cross site scripting