What’s Vulnerable › Products

DotNetNuke CMS Fixed in 9.1.1 vulnerabilities

76 known vulnerabilities, 3 confirmed exploited in the wild (CISA KEV), 32 published in the last 12 months.

Check whether your DotNetNuke CMS Fixed in 9.1.1 version is affected

Exploited DotNetNuke CMS Fixed in 9.1.1 vulnerabilities

• CVE-2018-18325 — DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
• CVE-2018-15811 — DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
• CVE-2017-9822 — DotNetNuke (DNN) Remote Code Execution Vulnerability

Latest DotNetNuke CMS Fixed in 9.1.1 vulnerabilities

• CVE-2026-40321 — DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload (CVSS 8.0)
• CVE-2026-40306 — DNN has same HostGUID for all new installs (CVSS 6.5)
• CVE-2026-40305 — DNN has Force Friend Request Acceptance (CVSS 4.3)
• CVE-2020-37103 — DotNetNuke 9.5 - Persistent Cross-Site Scripting (CVSS 5.4)
• CVE-2026-24838 — DotNetNuke.Core Vulnerable to Stored XSS via Module Title (CVSS 5.4)
• CVE-2026-24837 — DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal (CVSS 5.4)
• CVE-2026-24836 — DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes (CVSS 5.4)
• CVE-2026-24833 — DotNetNuke.Core Vulnerable to Stored XSS in Module Description (CVSS 5.4)
• CVE-2026-24784 — DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer (CVSS 4.8)
• CVE-2025-64095 — DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite (CVSS 9.8)
• CVE-2025-64094 — DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload (CVSS 5.4)
• CVE-2025-62802 — DNN CKEditor Provider allows unauthenticated upload out-of-the-box (CVSS 4.3)
• CVE-2025-59821 — DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile (CVSS 6.1)
• CVE-2025-59548 — DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser (CVSS 6.1)
• CVE-2025-59547 — DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation (CVSS 5.3)
• CVE-2025-59546 — DNN Vulnerable to Stored XSS Using Backend Admin Credentials (CVSS 4.8)
• CVE-2025-59545 — DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module (CVSS 9.0)
• CVE-2025-59539 — DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field (CVSS 5.4)
• CVE-2025-59535 — DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters (CVSS 6.5)
• CVE-2025-52488 — DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input (CVSS 8.6)
• CVE-2025-52487 — DNN.PLATFORM possibly allows bypass of IP Filters (CVSS 7.5)
• CVE-2025-52486 — DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects (CVSS 6.1)
• CVE-2025-52485 — DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed (CVSS 5.4)
• CVE-2025-48378 — Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline (CVSS 5.4)
• CVE-2025-48377 — Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode (CVSS 5.4)