DotNetNuke.Core (NuGet)
Advisories
44
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 10.2.2 or later clears every advisory below that has a fix.
Upgrade commands
dotnet
dotnet add package DotNetNuke.Core --version 10.2.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-fcpv-w245-r2q7 DotNetNuke.Core security code analysis rules triggered |
Low | >= 6.0.0, < 10.2.2 | 10.2.2 |
| GHSA-2rhw-gw3f-477j DNN: Same HostGUID for all new installs |
Medium EPSS 0.18% |
>= 10.0.0, < 10.2.2 | 10.2.2 |
| GHSA-fpj4-9qhx-5m6m DNN: Force Friend Request Acceptance |
Medium EPSS 0.18% |
>= 6.0.0, < 10.2.2 | 10.2.2 |
| GHSA-ffq7-898w-9jc4 DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload |
High EPSS 6.41% |
< 10.2.2 | 10.2.2 |
| GHSA-w9pf-h6m6-v89h DotNetNuke.Core Vulnerable to Stored XSS via Module Title |
Medium EPSS 0.22% |
>= 10.0.0, < 10.2.0 | 10.2.0 |
| GHSA-w9pf-h6m6-v89h DotNetNuke.Core Vulnerable to Stored XSS via Module Title |
Medium EPSS 0.22% |
< 9.13.10 | 9.13.10 |
| GHSA-vm5q-8qww-h238 DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal |
Medium EPSS 0.28% |
>= 9.0.0, <= 9.13.9 | No fix yet |
| GHSA-vm5q-8qww-h238 DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal |
Medium EPSS 0.28% |
>= 10.0.0, < 10.2.0 | 10.2.0 |
| GHSA-2g5g-hcgh-q3rp DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes |
Medium EPSS 0.26% |
>= 10.0.0, < 10.02.0 | 10.02.0 |
| GHSA-2g5g-hcgh-q3rp DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes |
Medium EPSS 0.26% |
>= 9.0.0, <= 9.13.9 | No fix yet |
| GHSA-jjwg-4948-6wxp DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer |
Medium EPSS 0.19% |
>= 10.0.0, < 10.2.0 | 10.2.0 |
| GHSA-jjwg-4948-6wxp DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer |
Medium EPSS 0.19% |
>= 9.0.0, < 9.13.10 | 9.13.10 |
| GHSA-hmvq-8p83-cq52 DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload |
Medium EPSS 0.19% |
< 10.1.1 | 10.1.1 |
| GHSA-jc4g-c8ww-5738 DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile |
Medium EPSS 0.21% |
< 10.1.0 | 10.1.0 |
| GHSA-gj8m-5492-q98h DNN Vulnerable to Stored XSS Using Backend Admin Credentials |
Medium EPSS 0.18% |
< 10.1.0 | 10.1.0 |
| GHSA-2qxc-mf4x-wr29 DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module |
Critical EPSS 0.50% |
< 10.1.0 | 10.1.0 |
| GHSA-7rcc-q6rq-jpcm DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field |
Medium EPSS 0.18% |
< 10.1.0 | 10.1.0 |
| GHSA-wq2j-w9pm-7x2p DNN allows loading unused themes on anonymous clients through query parameters |
Medium EPSS 0.43% |
< 10.1.0 | 10.1.0 |
| GHSA-m4hf-fxcg-cp34 DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline |
Medium EPSS 0.29% |
< 9.13.9 | 9.13.9 |
| GHSA-79m3-rvx2-3qq9 Reflected Cross-Site Scripting (XSS) in module actions in edit mode |
Medium EPSS 0.24% |
< 9.13.9 | 9.13.9 |
| GHSA-3f7v-qx94-666m DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF) |
High EPSS 0.38% |
< 9.13.8 | 9.13.8 |
| GHSA-9w72-2f23-57gm DNN vulnerable to Relative Path Traversal |
Medium EPSS 1.29% |
< 9.11.0 | 9.11.0 |
| GHSA-vjcm-j85r-7p68 DNN File Upload Vulnerability |
Medium EPSS 1.85% |
<= 9.4.4 | No fix yet |
| GHSA-4qf5-7xc2-wqpg DNN Path Traversal via Zip Slip |
High EPSS 2.39% |
< 9.5.0 | 9.5.0 |
| GHSA-9phr-h5mx-4fp6 DNN XSS Vulnerability |
Medium EPSS 0.88% |
<= 9.4.4 | No fix yet |
| GHSA-mj48-f959-pqph DotNetNuke (DNN) Open redirect vulnerability |
Medium EPSS 1.17% |
>= 7.0, < 7.1.1 | 7.1.1 |
| GHSA-mj48-f959-pqph DotNetNuke (DNN) Open redirect vulnerability |
Medium EPSS 1.17% |
< 6.2.9 | 6.2.9 |
| GHSA-rvrj-j7cc-236p DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter |
Medium EPSS 2.47% |
>= 7.0, < 7.1.1 | 7.1.1 |
| GHSA-rvrj-j7cc-236p DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter |
Medium EPSS 2.47% |
< 6.2.9 | 6.2.9 |
| GHSA-grw3-hjjm-5cjm DotNetNuke Default Machine Key Exposure |
Medium EPSS 2.48% |
< 4.8.2 | 4.8.2 |
| GHSA-m6w9-8cxc-jff7 DNN XSS Vulnerability |
Medium EPSS 1.14% |
<= 9.1.1 | No fix yet |
| GHSA-xr96-7ccp-pg5c DotNetNuke Vulnerable to XSS in Pass-Through Values |
Medium EPSS 1.25% |
< 03.02.01 | 03.02.01 |
| GHSA-5whq-j5qg-wjvp Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke |
Medium EPSS 6.15% |
< 9.4.0 | 9.4.0 |
| GHSA-pf46-gqg9-j3v3 Insufficient Entropy in DotNetNuke |
High EPSS 47.19% |
>= 9.2.0, < 9.2.2 | 9.2.2 |
| GHSA-xx3h-j3cx-8qfj Insufficient Entropy in DotNetNuke |
High EPSS 54.27% |
< 9.3.0 | 9.3.0 |
| CVE-2018-18325 Inadequate Encryption Strength in DotNetNuke Known exploited |
High EPSS 74.05% |
< 9.3.0 | 9.3.0 |
| CVE-2018-18325 Inadequate Encryption Strength in DotNetNuke Known exploited |
High EPSS 74.05% |
< 9.3.0 | 9.3.0 |
| CVE-2018-15811 Inadequate Encryption Strength in DotNetNuke Known exploited |
High EPSS 76.30% |
>= 9.2.0, < 9.2.2 | 9.2.2 |
| CVE-2018-15811 Inadequate Encryption Strength in DotNetNuke Known exploited |
High EPSS 76.30% |
>= 9.2.0, < 9.2.2 | 9.2.2 |
| GHSA-x2rg-fmcv-crq5 DNN (aka DotNetNuke) has Remote Code Execution via a cookie Known exploited |
High EPSS 94.79% |
< 9.1.1 | 9.1.1 |
| GHSA-5c66-x4wm-rjfx Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) |
Medium EPSS 0.66% |
< 8.0.1 | 8.0.1 |
| GHSA-x8f7-h444-97w4 The installation wizard in DotNetNuke (DNN) allows privilege escalation |
Critical EPSS 75.12% |
< 7.4.1 | 7.4.1 |
| GHSA-v76m-f5cx-8rg4 Moderate severity vulnerability that affects DotNetNuke.Core |
Medium EPSS 1.76% |
< 7.4.0 | 7.4.0 |
| GHSA-g8j6-m4p7-5rfq High severity vulnerability that affects DotNetNuke.Core |
High EPSS 12.54% |
< 9.2.0 | 9.2.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor