by Kastro
Paper/Archive/CVE-2026-24838

CVE-2026-24838

dnnsoftware Dnn.Platform — DotNetNuke.Core Vulnerable to Stored XSS via Module Title

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
30
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 13.2.132 × 202.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

Affected

ProductAffectedFixed inSource
Dnn.Platform< 9.13.10–CNA
Dnn.Platform>= 10.0.0, < 10.2.0–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-w9pf-h6m6-v89h