PT-2025-39081 · Dotnetnuke · Dnn

6Teloiv · Published 2025-09-22 · Updated 2025-09-29 · CVE-2025-59535

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions DNN (formerly DotNetNuke) versions prior to 10.1.0

Description DNN is an open-source web content management platform. Prior to version 10.1.0, arbitrary themes could be loaded through query parameters. This allowed potentially vulnerable, unused themes to be loaded for unsuspecting clients without the site owner’s knowledge. Depending on the vulnerability within a theme, this could lead to server-side or client-side arbitrary code execution.

Recommendations Update to version 10.1.0 or later.

Exploit

Fix

Information Disclosure

RCE

Weakness Enumeration

CWE-829

CWE-200

CWE-20

Related Identifiers

CVE-2025-59535

GHSA-WQ2J-W9PM-7X2P

Affected Products

Dnn

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59535.json · Exploit
• https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-wq2j-w9pm-7x2p · Vendor Advisory
• https://github.com/dnnsoftware/Dnn.Platform/commit/72f30f69fd2214d77f6c2577dfcca495a24caf5c · Patch
• https://osv.dev/vulnerability/GHSA-wq2j-w9pm-7x2p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59535 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59535 · Vendor Advisory
• https://github.com/dnnsoftware/Dnn.Platform · Note
• https://github.com/dnnsoftware/Dnn.Platform/blob/develop/DNN%20Platform/Library/UI/Skins/Skin.cs#L305 · Note
• https://twitter.com/VulmonFeeds/status/1970275672862896130 · Twitter Post
• https://twitter.com/CVEnew/status/1970255634907169259 · Twitter Post
• https://t.me/CVEtracker/33098 · Telegram Post
• https://dnncommunity.org/?SkinSrc=%5BG%5Dskins%2Fxcillion%2Fhome&ContainerSrc=%5BG%5DContainers%2FXcillion%2FNoTitle · Note
• https://t.me/cveNotify/136797 · Telegram Post
• https://twitter.com/VolerionSec/status/1970245454911688898 · Twitter Post