DotNetNuke.Core Known Vulnerabilities & Fixes
DotNetNuke.Core has 20 known security vulnerabilities in NuGet (.NET). Upgrade to version 10.2.2 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
Actively Exploited
CISA has confirmed this package has vulnerabilities under active exploitation. Prioritize updating immediately.
Recommended safe version: 10.2.2
Upgrading to 10.2.2 or later resolves all 20 known vulnerabilities in DotNetNuke.Core. Run: dotnet add package DotNetNuke.Core --version 10.2.2
Is DotNetNuke.Core in your project?
Check if you're affected and upgrade to 10.2.2 to stay secure.
Active Exploitation Warning
One or more vulnerabilities in this package are known to be actively exploited in the wild. Immediate action is recommended.
Security Summary
- 24 affected version ranges have been identified across these 20 advisories.
- 100% of known issues have a published fixed version.
- Remediation: dotnet add package DotNetNuke.Core
Vulnerabilities
20 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Oct 16, 2018, most recently Apr 10, 2026 (2733 days apart).
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2018-15811 Inadequate Encryption Strength in DotNetNuke | HIGH | 9.2.0.366, 9.2.1.533 | 9.2.2 |
| CVE-2018-18325 Inadequate Encryption Strength in DotNetNuke | HIGH | 6.0.0, 7.0.0, 7.0.6.121, 7.1.0 (+18 more) | 9.3.0 |
| CVE-2017-9822 DNN (aka DotNetNuke) has Remote Code Execution via a cookie | HIGH | 6.0.0, 7.0.0, 7.0.6.121, 7.1.0 (+15 more) | 9.1.1 |
| CVE-2026-24838 DotNetNuke.Core Vulnerable to Stored XSS via Module Title | CRITICAL | 6.0.0, 7.0.0, 7.0.6.121, 7.1.0 (+60 more) | 9.13.10, 10.2.0 |
| CVE-2025-59545 DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module | CRITICAL | 10.0.0, 10.0.1, 6.0.0, 7.0.0 (+57 more) | 10.1.0 |
| CVE-2015-2794 The installation wizard in DotNetNuke (DNN) allows privilege escalation | CRITICAL | 6.0.0, 7.0.0, 7.0.6.121, 7.1.0 (+5 more) | 7.4.1 |
| CVE-2017-0929 High severity vulnerability that affects DotNetNuke.Core | HIGH | 6.0.0, 7.0.0, 7.0.6.121, 7.1.0 (+16 more) | 9.2.0 |
| CVE-2026-40321 DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload | HIGH | 10.0.0, 10.0.1, 10.1.0, 10.1.1 (+62 more) | 10.2.2 |
| CVE-2026-24837 DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal | HIGH | 9.0.0.1002, 9.0.1.142, 9.1.0.367, 9.1.1.129 (+44 more) | 10.2.0 |
| CVE-2026-24836 DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes | HIGH | 9.0.0.1002, 9.0.1.142, 9.1.0.367, 9.1.1.129 (+44 more) | 10.02.0 |
| CVE-2020-5187 DNN Path Traversal via Zip Slip | HIGH | 6.0.0, 7.0.0, 7.0.6.121, 7.1.0 (+26 more) | 9.5.0 |
| CVE-2026-24784 DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer | MEDIUM | 9.0.0.1002, 9.0.1.142, 9.1.0.367, 9.1.1.129 (+44 more) | 9.13.10, 10.2.0 |
| CVE-2026-40306 DNN: Same HostGUID for all new installs | MEDIUM | 10.0.0, 10.0.1, 10.1.0, 10.1.1 (+3 more) | 10.2.2 |
| CVE-2025-48378 DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline | MEDIUM | 6.0.0, 7.0.0, 7.0.6.121, 7.1.0 (+54 more) | 9.13.9 |
| CVE-2025-59821 DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile | MEDIUM | 10.0.0, 10.0.1, 6.0.0, 7.0.0 (+57 more) | 10.1.0 |
| CVE-2025-59535 DNN allows loading unused themes on anonymous clients through query parameters | MEDIUM | 10.0.0, 10.0.1, 6.0.0, 7.0.0 (+57 more) | 10.1.0 |
| CVE-2025-48377 Reflected Cross-Site Scripting (XSS) in module actions in edit mode | MEDIUM | 6.0.0, 7.0.0, 7.0.6.121, 7.1.0 (+54 more) | 9.13.9 |
| CVE-2025-64094 DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload | MEDIUM | 10.0.0, 10.0.1, 10.1.0, 6.0.0 (+58 more) | 10.1.1 |
| CVE-2025-32372 DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF) | MEDIUM | 6.0.0, 7.0.0, 7.0.6.121, 7.1.0 (+53 more) | 9.13.8 |
| CVE-2025-59539 DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field | MEDIUM | 10.0.0, 10.0.1, 6.0.0, 7.0.0 (+57 more) | 10.1.0 |
About This Data
Vulnerability data for DotNetNuke.Core is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related NuGet (.NET) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of DotNetNuke.Core.