VulnerabilityAnalyzed

CVE-2025-59545

Prior to version 10.1.0, the Prompt module allows execution of commands that can return raw HTML.

CRITICAL 9.0EPSS 0.49%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution (XSS). This issue has been patched in version 10.1.0.

CVSS 3.1: 9.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS: 0.49% probability · 40th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: dnnsoftware/dotnetnuke
Source: security-advisories@github.com

References

https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2qxc-mf4x-wr29Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.