CVE-2015-2794

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 75.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-02-06 · updated 2026-06-17
Weakness: CWE-264

Description

The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.

Affected products

DotNetNuke CMS Fixed in 9.1.1: through 07.04.00

References

http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue
http://www.dnnsoftware.com/community/security/security-center
http://www.securityfocus.com/bid/96373
https://dotnetnuke.codeplex.com/releases/view/615317
https://www.exploit-db.com/exploits/39777/
http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue
http://www.dnnsoftware.com/community/security/security-center
http://www.securityfocus.com/bid/96373
https://dotnetnuke.codeplex.com/releases/view/615317
https://www.exploit-db.com/exploits/39777/

Get alerted when CVE-2015-2794 or the next vulnerability affects your stack