{"schema_version":1,"title":"DotNetNuke.Core (NuGet) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 31 vulnerabilities in DotNetNuke.Core (NuGet): 0 in the last 7 days and 0 in the last 90 days, 3 of them critical and 3 exploited in the wild. The most recent, DotNetNuke.Core security code analysis rules triggered, was published on 14 April 2026.","url":"https://junglewise.ai/threats/technologies/dotnetnuke-core","json_url":"https://junglewise.ai/threats/technologies/dotnetnuke-core.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/dotnetnuke-core","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":1,"all_time":31,"critical":3,"exploited":3,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":6},"latest":[{"slug":"dotnetnuke-core-security-code-analysis-rules-triggered-e47b3d10","title":"DotNetNuke.Core security code analysis rules triggered","severity":"info","exploited":false,"published_at":"2026-04-14T23:33:30+00:00","url":"https://junglewise.ai/threats/dotnetnuke-core-security-code-analysis-rules-triggered-e47b3d10"},{"cvss":0,"slug":"dnn-dotnetnuke-core-insecure-xml-processing-and-weak-cryptography-fd6489d4","title":"DNN DotNetNuke.Core insecure XML processing and weak cryptography","severity":"low","exploited":false,"published_at":"2026-04-14T23:33:30+00:00","url":"https://junglewise.ai/threats/dnn-dotnetnuke-core-insecure-xml-processing-and-weak-cryptography-fd6489d4"},{"cve":"CVE-2026-40306","cvss":6.5,"epss":0.0029,"slug":"cve-2026-40306-dnn-same-hostguid-for-all-new-installs","title":"DNN: Same HostGUID for all new installs","severity":"medium","exploited":false,"published_at":"2026-04-10T21:07:13+00:00","url":"https://junglewise.ai/threats/cve-2026-40306-dnn-same-hostguid-for-all-new-installs"},{"cve":"CVE-2026-40305","cvss":4.3,"epss":0.0031,"slug":"cve-2026-40305-dnn-force-friend-request-acceptance","title":"DNN: Force Friend Request Acceptance","severity":"medium","exploited":false,"published_at":"2026-04-10T21:07:08+00:00","url":"https://junglewise.ai/threats/cve-2026-40305-dnn-force-friend-request-acceptance"},{"cve":"CVE-2026-40321","cvss":8,"epss":0.0036,"slug":"cve-2026-40321-dotnetnuke-core-has-stored-cross-site-scripting-xss-via-svg","title":"DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload","severity":"high","exploited":false,"published_at":"2026-04-10T20:42:48+00:00","url":"https://junglewise.ai/threats/cve-2026-40321-dotnetnuke-core-has-stored-cross-site-scripting-xss-via-svg"},{"cve":"CVE-2025-64094","cvss":3.1,"epss":0.0018,"slug":"cve-2025-64094-dnn-vulnerable-to-stored-cross-site-scripting-xss-via-svg-upload","title":"DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload","severity":"low","exploited":false,"published_at":"2025-10-29T21:47:49+00:00","url":"https://junglewise.ai/threats/cve-2025-64094-dnn-vulnerable-to-stored-cross-site-scripting-xss-via-svg-upload"},{"cve":"CVE-2025-59821","cvss":3.1,"epss":0.0021,"slug":"cve-2025-59821-dnn-vulnerable-to-reflected-cross-site-scripting-xss-using-url-to","title":"DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile","severity":"low","exploited":false,"published_at":"2025-09-23T15:09:47+00:00","url":"https://junglewise.ai/threats/cve-2025-59821-dnn-vulnerable-to-reflected-cross-site-scripting-xss-using-url-to"},{"cve":"CVE-2025-59546","cvss":3.1,"epss":0.0018,"slug":"cve-2025-59546-dnn-vulnerable-to-stored-xss-using-backend-admin-credentials","title":"DNN Vulnerable to Stored XSS Using Backend Admin Credentials","severity":"low","exploited":false,"published_at":"2025-09-23T15:09:39+00:00","url":"https://junglewise.ai/threats/cve-2025-59546-dnn-vulnerable-to-stored-xss-using-backend-admin-credentials"},{"cve":"CVE-2025-59545","cvss":3.1,"epss":0.0049,"slug":"cve-2025-59545-dnn-vulnerable-to-stored-cross-site-scripting-xss-in-the-prompt","title":"DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module","severity":"low","exploited":false,"published_at":"2025-09-23T15:09:19+00:00","url":"https://junglewise.ai/threats/cve-2025-59545-dnn-vulnerable-to-stored-cross-site-scripting-xss-in-the-prompt"},{"cve":"CVE-2025-59539","cvss":3.1,"epss":0.0018,"slug":"cve-2025-59539-dnn-affected-by-stored-cross-site-scripting-xss-in-profile","title":"DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field","severity":"low","exploited":false,"published_at":"2025-09-22T21:51:04+00:00","url":"https://junglewise.ai/threats/cve-2025-59539-dnn-affected-by-stored-cross-site-scripting-xss-in-profile"},{"cve":"CVE-2025-59535","cvss":3.1,"epss":0.0034,"slug":"cve-2025-59535-dnn-allows-loading-unused-themes-on-anonymous-clients-through","title":"DNN allows loading unused themes on anonymous clients through query parameters","severity":"low","exploited":false,"published_at":"2025-09-22T21:10:20+00:00","url":"https://junglewise.ai/threats/cve-2025-59535-dnn-allows-loading-unused-themes-on-anonymous-clients-through"},{"cve":"CVE-2025-48378","cvss":4,"epss":0.0028,"slug":"cve-2025-48378-dnn-allows-stored-cross-site-scripting-xss-with-svg-files","title":"DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline","severity":"medium","exploited":false,"published_at":"2025-05-23T16:58:08+00:00","url":"https://junglewise.ai/threats/cve-2025-48378-dnn-allows-stored-cross-site-scripting-xss-with-svg-files"},{"cve":"CVE-2025-48377","cvss":4,"epss":0.0023,"slug":"cve-2025-48377-reflected-cross-site-scripting-xss-in-module-actions-in-edit-mode","title":"Reflected Cross-Site Scripting (XSS) in module actions in edit mode","severity":"medium","exploited":false,"published_at":"2025-05-23T16:36:08+00:00","url":"https://junglewise.ai/threats/cve-2025-48377-reflected-cross-site-scripting-xss-in-module-actions-in-edit-mode"},{"cve":"CVE-2025-32372","cvss":3.1,"epss":0.0038,"slug":"cve-2025-32372-dotnetnuke-core-vulnerable-to-server-side-request-forgery-ssrf","title":"DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)","severity":"low","exploited":false,"published_at":"2025-04-09T12:58:28+00:00","url":"https://junglewise.ai/threats/cve-2025-32372-dotnetnuke-core-vulnerable-to-server-side-request-forgery-ssrf"},{"cve":"CVE-2022-2922","cvss":3.1,"epss":0.011,"slug":"cve-2022-2922-dnn-vulnerable-to-relative-path-traversal","title":"DNN vulnerable to Relative Path Traversal","severity":"low","exploited":false,"published_at":"2022-10-01T00:00:25+00:00","url":"https://junglewise.ai/threats/cve-2022-2922-dnn-vulnerable-to-relative-path-traversal"},{"cve":"CVE-2020-5188","cvss":3.1,"epss":0.0185,"slug":"cve-2020-5188-dnn-file-upload-vulnerability","title":"DNN File Upload Vulnerability","severity":"low","exploited":false,"published_at":"2022-05-24T17:09:34+00:00","url":"https://junglewise.ai/threats/cve-2020-5188-dnn-file-upload-vulnerability"},{"cve":"CVE-2020-5187","cvss":3.1,"epss":0.0239,"slug":"cve-2020-5187-dnn-path-traversal-via-zip-slip","title":"DNN Path Traversal via Zip Slip","severity":"low","exploited":false,"published_at":"2022-05-24T17:09:34+00:00","url":"https://junglewise.ai/threats/cve-2020-5187-dnn-path-traversal-via-zip-slip"},{"cve":"CVE-2020-5186","cvss":3.1,"epss":0.0088,"slug":"cve-2020-5186-dnn-xss-vulnerability","title":"DNN XSS Vulnerability","severity":"low","exploited":false,"published_at":"2022-05-24T17:09:33+00:00","url":"https://junglewise.ai/threats/cve-2020-5186-dnn-xss-vulnerability"},{"cve":"CVE-2008-6540","epss":0.0248,"slug":"cve-2008-6540-dotnetnuke-default-machine-key-exposure","title":"DotNetNuke Default Machine Key Exposure","severity":"info","exploited":false,"published_at":"2022-05-14T02:38:47+00:00","url":"https://junglewise.ai/threats/cve-2008-6540-dotnetnuke-default-machine-key-exposure"},{"cve":"CVE-2018-14486","cvss":3,"epss":0.0114,"slug":"cve-2018-14486-dnn-xss-vulnerability","title":"DNN XSS Vulnerability","severity":"low","exploited":false,"published_at":"2022-05-14T01:17:48+00:00","url":"https://junglewise.ai/threats/cve-2018-14486-dnn-xss-vulnerability"},{"cve":"CVE-2007-0660","epss":0.0124,"slug":"cve-2007-0660-dotnetnuke-vulnerable-to-xss-in-pass-through-values","title":"DotNetNuke Vulnerable to XSS in Pass-Through Values","severity":"info","exploited":false,"published_at":"2022-05-01T17:46:11+00:00","url":"https://junglewise.ai/threats/cve-2007-0660-dotnetnuke-vulnerable-to-xss-in-pass-through-values"},{"cve":"CVE-2019-12562","cvss":3.1,"epss":0.0615,"slug":"cve-2019-12562-stored-cross-site-scripting-vulnerability-in-admin-component-of","title":"Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke","severity":"low","exploited":false,"published_at":"2019-11-18T17:16:06+00:00","url":"https://junglewise.ai/threats/cve-2019-12562-stored-cross-site-scripting-vulnerability-in-admin-component-of"},{"cve":"CVE-2018-15811","cvss":3,"epss":0.7614,"slug":"cve-2018-15811-dotnetnuke-dnn-inadequate-encryption-strength-vulnerability","title":"Inadequate Encryption Strength in DotNetNuke","severity":"critical","exploited":true,"published_at":"2019-07-05T21:08:36+00:00","url":"https://junglewise.ai/threats/cve-2018-15811-dotnetnuke-dnn-inadequate-encryption-strength-vulnerability"},{"cve":"CVE-2018-15812","cvss":3,"epss":0.4719,"slug":"cve-2018-15812-insufficient-entropy-in-dotnetnuke","title":"Insufficient Entropy in DotNetNuke","severity":"low","exploited":false,"published_at":"2019-07-05T21:08:24+00:00","url":"https://junglewise.ai/threats/cve-2018-15812-insufficient-entropy-in-dotnetnuke"},{"cve":"CVE-2018-18326","cvss":3,"epss":0.5427,"slug":"cve-2018-18326-insufficient-entropy-in-dotnetnuke","title":"Insufficient Entropy in DotNetNuke","severity":"low","exploited":false,"published_at":"2019-07-05T21:08:20+00:00","url":"https://junglewise.ai/threats/cve-2018-18326-insufficient-entropy-in-dotnetnuke"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Magick.NET-Q16-AnyCPU (NuGet)","slug":"magick-net-q16-anycpu","vulnerabilities":56,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-anycpu"},{"name":"Magick.NET-Q16-HDRI-AnyCPU (NuGet)","slug":"magick-net-q16-hdri-anycpu","vulnerabilities":52,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-hdri-anycpu"},{"name":"Magick.NET-Q16-HDRI-x86 (NuGet)","slug":"magick-net-q16-hdri-x86","vulnerabilities":52,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x86"},{"name":"Magick.NET-Q16-x86 (NuGet)","slug":"magick-net-q16-x86","vulnerabilities":52,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-x86"},{"name":"Magick.NET-Q8-AnyCPU (NuGet)","slug":"magick-net-q8-anycpu","vulnerabilities":51,"url":"https://junglewise.ai/threats/technologies/magick-net-q8-anycpu"},{"name":"Magick.NET-Q8-OpenMP-x64 (NuGet)","slug":"magick-net-q8-openmp-x64","vulnerabilities":51,"url":"https://junglewise.ai/threats/technologies/magick-net-q8-openmp-x64"},{"name":"Magick.NET-Q8-x86 (NuGet)","slug":"magick-net-q8-x86","vulnerabilities":51,"url":"https://junglewise.ai/threats/technologies/magick-net-q8-x86"},{"name":"Magick.NET-Q16-OpenMP-x64 (NuGet)","slug":"magick-net-q16-openmp-x64","vulnerabilities":50,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-openmp-x64"},{"name":"Magick.NET-Q16-arm64 (NuGet)","slug":"magick-net-q16-arm64","vulnerabilities":49,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-arm64"},{"name":"Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet)","slug":"magick-net-q16-hdri-openmp-arm64","vulnerabilities":49,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-hdri-openmp-arm64"},{"name":"Magick.NET-Q16-HDRI-x64 (NuGet)","slug":"magick-net-q16-hdri-x64","vulnerabilities":49,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x64"},{"name":"Magick.NET-Q16-OpenMP-arm64 (NuGet)","slug":"magick-net-q16-openmp-arm64","vulnerabilities":49,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-openmp-arm64"}],"technology":{"hub":true,"name":"DotNetNuke.Core (NuGet)","slug":"dotnetnuke-core","vendor":{"name":"NuGet","slug":"nuget","url":"https://junglewise.ai/threats/vendors/nuget"},"aliases":[],"homepage":"https://www.dnnsoftware.com/","repo_url":"https://github.com/dnnsoftware/Dnn.Platform","description":"The core library for the DotNetNuke (DNN) CMS platform, providing essential services for web application management.","url":"https://junglewise.ai/threats/technologies/dotnetnuke-core"},"most_severe":[{"cve":"CVE-2017-9822","cvss":3.1,"epss":0.9479,"slug":"cve-2017-9822-dotnetnuke-dnn-remote-code-execution-vulnerability","title":"DNN (aka DotNetNuke) has Remote Code Execution via a cookie","severity":"critical","exploited":true,"published_at":"2018-10-16T19:34:22+00:00","url":"https://junglewise.ai/threats/cve-2017-9822-dotnetnuke-dnn-remote-code-execution-vulnerability"},{"cve":"CVE-2018-15811","cvss":3,"epss":0.7614,"slug":"cve-2018-15811-dotnetnuke-dnn-inadequate-encryption-strength-vulnerability","title":"Inadequate Encryption Strength in DotNetNuke","severity":"critical","exploited":true,"published_at":"2019-07-05T21:08:36+00:00","url":"https://junglewise.ai/threats/cve-2018-15811-dotnetnuke-dnn-inadequate-encryption-strength-vulnerability"},{"cve":"CVE-2018-18325","cvss":3,"epss":0.7387,"slug":"cve-2018-18325-dotnetnuke-dnn-inadequate-encryption-strength-vulnerability","title":"Inadequate Encryption Strength in DotNetNuke","severity":"critical","exploited":true,"published_at":"2019-07-05T21:08:16+00:00","url":"https://junglewise.ai/threats/cve-2018-18325-dotnetnuke-dnn-inadequate-encryption-strength-vulnerability"},{"cve":"CVE-2026-40321","cvss":8,"epss":0.0036,"slug":"cve-2026-40321-dotnetnuke-core-has-stored-cross-site-scripting-xss-via-svg","title":"DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload","severity":"high","exploited":false,"published_at":"2026-04-10T20:42:48+00:00","url":"https://junglewise.ai/threats/cve-2026-40321-dotnetnuke-core-has-stored-cross-site-scripting-xss-via-svg"},{"cve":"CVE-2026-40306","cvss":6.5,"epss":0.0029,"slug":"cve-2026-40306-dnn-same-hostguid-for-all-new-installs","title":"DNN: Same HostGUID for all new installs","severity":"medium","exploited":false,"published_at":"2026-04-10T21:07:13+00:00","url":"https://junglewise.ai/threats/cve-2026-40306-dnn-same-hostguid-for-all-new-installs"},{"cve":"CVE-2026-40305","cvss":4.3,"epss":0.0031,"slug":"cve-2026-40305-dnn-force-friend-request-acceptance","title":"DNN: Force Friend Request Acceptance","severity":"medium","exploited":false,"published_at":"2026-04-10T21:07:08+00:00","url":"https://junglewise.ai/threats/cve-2026-40305-dnn-force-friend-request-acceptance"},{"cve":"CVE-2025-48378","cvss":4,"epss":0.0028,"slug":"cve-2025-48378-dnn-allows-stored-cross-site-scripting-xss-with-svg-files","title":"DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline","severity":"medium","exploited":false,"published_at":"2025-05-23T16:58:08+00:00","url":"https://junglewise.ai/threats/cve-2025-48378-dnn-allows-stored-cross-site-scripting-xss-with-svg-files"},{"cve":"CVE-2025-48377","cvss":4,"epss":0.0023,"slug":"cve-2025-48377-reflected-cross-site-scripting-xss-in-module-actions-in-edit-mode","title":"Reflected Cross-Site Scripting (XSS) in module actions in edit mode","severity":"medium","exploited":false,"published_at":"2025-05-23T16:36:08+00:00","url":"https://junglewise.ai/threats/cve-2025-48377-reflected-cross-site-scripting-xss-in-module-actions-in-edit-mode"},{"cve":"CVE-2019-12562","cvss":3.1,"epss":0.0615,"slug":"cve-2019-12562-stored-cross-site-scripting-vulnerability-in-admin-component-of","title":"Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke","severity":"low","exploited":false,"published_at":"2019-11-18T17:16:06+00:00","url":"https://junglewise.ai/threats/cve-2019-12562-stored-cross-site-scripting-vulnerability-in-admin-component-of"},{"cve":"CVE-2020-5187","cvss":3.1,"epss":0.0239,"slug":"cve-2020-5187-dnn-path-traversal-via-zip-slip","title":"DNN Path Traversal via Zip Slip","severity":"low","exploited":false,"published_at":"2022-05-24T17:09:34+00:00","url":"https://junglewise.ai/threats/cve-2020-5187-dnn-path-traversal-via-zip-slip"}],"generated_at":"2026-09-26T18:07:00.158435+00:00"}