Bdukes

**Name of the Vulnerable Software and Affected Versions** DNN (formerly DotNetNuke) versions prior to 9.13.10 DNN (formerly DotNetNuke) versions prior to 10.2.0 **Description** DNN (formerly DotNetNuke) is an open-source web content management platform. Prior to versions 9.13.10 and 10.2.0, the module title field allowed rich text, which could include scripts that could execute under certain conditions. **Recommendations** Update to DNN version 9.13.10 or later. Update to DNN version 10.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** DNN (formerly DotNetNuke) versions prior to 10.1.0 **Description** DNN (formerly DotNetNuke) is an open-source web content management platform. Administrators and content editors could set HTML in module titles, potentially including JavaScript. This could be leveraged for cross-site scripting (XSS) attacks. The issue was addressed in version 10.1.0. **Recommendations** Update to version 10.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** DNN (formerly DotNetNuke) versions prior to 10.1.0 **Description** DNN (formerly DotNetNuke) is an open-source web content management platform. Prior to version 10.1.0, the Biography field allowed injection of javascript code, even when not configured for rich-text input. This code could execute in the context of the website for any user viewing the profile, including administrators and superusers. **Recommendations** Update to version 10.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** DNN (formerly DotNetNuke) versions prior to 10.1.0 **Description** DNN (formerly DotNetNuke) is an open-source web content management platform. The Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, potentially leading to script execution (XSS). **Recommendations** Update to version 10.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** DNN (formerly DotNetNuke) versions prior to 10.1.0 **Description** DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. The application does not sufficiently neutralize or encode characters that are meaningful in HTML, potentially allowing an attacker to cause a victim’s browser to interpret attacker-controlled content as part of the page’s HTML. This is a reflected cross-site scripting issue. **Recommendations** Update to version 10.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** DNN (formerly DotNetNuke) versions prior to 9.13.9 **Description** The issue concerns the DNN (formerly DotNetNuke) open-source web content management platform, which is part of the Microsoft ecosystem. In affected versions, uploaded SVG files could contain scripts. If these SVG files are rendered inline, the scripts could run, allowing cross-site scripting (XSS) attacks. **Recommendations** For versions prior to 9.13.9, update to version 9.13.9 to resolve the issue. As a temporary workaround, consider restricting the upload of SVG files or disabling the rendering of SVG files inline until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** DNN (formerly DotNetNuke) versions prior to 9.13.9 **Description** A specially crafted URL may be constructed to inject an XSS payload that is triggered by using some module actions. **Recommendations** For versions prior to 9.13.9, update to version 9.13.9 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** DNN (formerly DotNetNuke) versions prior to 10.1.0 **Description** DNN (formerly DotNetNuke) is an open-source web content management platform. Versions prior to 10.1.0 have a javascript injection issue related to specially crafted URLs to the FileBrowser. Clicking these URLs can affect users. The issue impacts any unsuspecting user. **Recommendations** Update to version 10.1.0 or later.