CVE-2025-59535

Katalog CVE

CVSS 6.5 · Medium EPSS 0,43%

Kerentanan Improper Input Validation pada dnnsoftware dotnetnuke. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.

Rincian

Terbit di NVD

22 September 2025

Terakhir diubah

11 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-wq2j-w9pm-7x2p advisory vendor
• https://github.com/dnnsoftware/Dnn.Platform/commit/72f30f69fd2214d77f6c2577dfcca495a24caf5c patch
• https://github.com/dnnsoftware/Dnn.Platform/blob/develop/DNN%20Platform/Library/UI/Skins/Skin.cs#L305 product