PT-2025-44221 · Dotnetnuke · Dnn

Published 2025-10-28 · Updated 2026-01-05 · CVE-2025-64095

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DNN (formerly DotNetNuke) versions prior to 10.1.1

Description DNN (formerly DotNetNuke) is an open-source web content management platform. The default HTML editor provider allows unauthenticated file uploads, enabling attackers to overwrite existing files. An unauthenticated user can upload and replace existing files, potentially leading to website defacement and the injection of cross-site scripting (XSS) payloads. Approximately 36,800 to 214,100 assets are estimated to be affected worldwide. The vulnerability allows for trivial site defacement and XSS attacks via image uploads.

Recommendations Upgrade to version 10.1.1 or later.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-64095

GHSA-3M8R-W7XG-JQVW

Affected Products

Dnn

References · 37

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64095.json · Exploit
• 🔥 https://github.com/NationalServices/CVE-2025-64095-DotNetNuke-DNN_PoC · Exploit
• https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-3m8r-w7xg-jqvw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64095 · Security Note
• https://osv.dev/vulnerability/GHSA-3m8r-w7xg-jqvw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64095 · Vendor Advisory
• https://github.com/dnnsoftware/Dnn.Platform · Note
• https://t.me/CSIRT_italia/3024 · Telegram Post
• https://t.me/proxy_bar/2841 · Telegram Post
• https://twitter.com/Netlas_io/status/1984231893026340931 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1on8u60/top_10_trending_cves_03112025 · Reddit Post
• https://t.me/pentestingnews/70353 · Telegram Post
• https://twitter.com/Karma_X_Inc/status/1984181772754505996 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ok2mxi/resumen_diario_de_vulnerabilidades_30102025 · Reddit Post
• https://twitter.com/CVEnew/status/1983296590996508798 · Twitter Post