UpHeron
All vulnerabilities

Servers and applications

CVE-2025-59539

Stored Cross-Site Scripting (XSS) in Profile Biography field

Severity
Medium 5.4
Published
22 Sept 2025
Last changed
11 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.1.0
Also known as
GHSA-7rcc-q6rq-jpcm
Sources
NVD, Project advisories (GitHub)

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers.…

Affected software

SoftwareAffected versions
DNN PlatformServers and applications · cpe:a:dnnsoftware:dotnetnuke
  • Every version before 10.1.0
  • Version 10.1.0-rc1
DNN PlatformServers and applications · github:dnnsoftware/dnn.platform
  • Every version before 10.1.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-59539
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-59539
  • GitHub Advisory Database https://github.com/advisories/GHSA-7rcc-q6rq-jpcm
  • github.com https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-7rcc-q6rq-jpcm