dotnetnuke vulnerabilities

Products

• dotnetnuke 1
• DotNetNuke CMS Fixed in 9.1.1 1
• dotnetnuke iframe 1

Latest dotnetnuke CVEs

Newest publication first

1. CVE-2017-9822 DNN (aka DotNetNuke) has Remote Code Execution via a cookie

   Published 2017-07-20

   High·CVSS 8.8 EPSS 94.8% CISA KEV added 2021-11-03 Ransomware Exploited in the wild Framework module Public exploit

   DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

2. CVE-2012-1036 Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.

   Published 2012-04-11

   Medium·CVSS 4.3

   Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.

3. CVE-2007-0660 DotNetNuke Vulnerable to XSS in Pass-Through Values

   Published 2007-02-01

   Medium·CVSS 6.8

   Cross-site scripting (XSS) vulnerability in the IFrame module before 03.02.01 for DotNetNuke (DNN) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values."

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.