DNN Software DotNetNuke any version

DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

** UNVERIFIABLE ** Unspecified vulnerability in an unspecified DNN Modules module for DotNetNuke (.net nuke) allows remote attackers to gain privileges via unspecified vectors, as used in an attack against the Microsoft France web site. NOTE: due to the lack of details and uncertainty about which product is affected, this claim is not independently verifiable.

The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.

DotNetNuke.Core Vulnerable to Stored XSS via Module Title

DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).

DNN.PLATFORM possibly allows bypass of IP Filters

DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input

DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload

DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

DotNetNuke.Core Vulnerable to Stored XSS in Module Description

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.

DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.

DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.

DNN CMS Server-Side Request Forgery (SSRF)

Possible Denial of Service (DoS) in DNN.PLATFORM registration

Server-Side Request Forgery (SSRF) in DotNetNuke.Core

DNN does not check the contents of a file when uploading files

DNN has same HostGUID for all new installs

Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrary files and gain privileges to the server via unspecified vectors.

DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer

DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.

DNN allows a registered user to enumerate and access files they should not have access to

DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters

DNN allows the possibility of bypassing Captcha

DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile

DotNetNuke 9.5 - Persistent Cross-Site Scripting

DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to the server, etc. Successful exploitation occurs when an admin user visits a notification page with stored cross-site scripting.

Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline

DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects

DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser

Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode

DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).

Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element.