CVE-2026-24833

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module could install with richtext in its description field which could contain scripts that will run for user in the Persona Bar. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.0 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-9r3h-mpf8-25gj	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dnnsoftware:dotnetnuke::::::::
	cpe:2.3:a:dnnsoftware:dotnetnuke::::::::

History

17 Jun 2026, 10:23

Type	Values Removed	Values Added
Summary		(es) DNN (anteriormente DotNetNuke) es una plataforma de gestión de contenido web (CMS) de código abierto en el ecosistema de Microsoft. Antes de las versiones 9.13.10 y 10.2.0, un módulo podía instalarse con texto enriquecido en su campo de descripción, el cual podía contener scripts que se ejecutarían para el usuario en la Barra Persona. Las versiones 9.13.10 y 10.2.0 contienen una solución para el problema.

04 Feb 2026, 20:12

Type	Values Removed	Values Added
References	~~() https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-9r3h-mpf8-25gj -~~	() https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-9r3h-mpf8-25gj - Vendor Advisory
CPE		cpe:2.3:a:dnnsoftware:dotnetnuke::::::::
First Time		Dnnsoftware dotnetnuke Dnnsoftware

28 Jan 2026, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-28 00:15

Updated : 2026-06-17 10:23

NVD link : CVE-2026-24833

Mitre link : CVE-2026-24833

CVE.ORG link : CVE-2026-24833

JSON object : View

Products Affected

dnnsoftware

dotnetnuke

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-24833", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24833", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-28T21:04:54.593397Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dnnsoftware", "product": "Dnn.Platform", "versions": [{"status": "affected", "version": "< 9.13.10"}, {"status": "affected", "version": ">= 10.0.0, < 10.2.0"}]}]}], "published": "2026-01-28T00:15:50.773", "references": [{"url": "https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-9r3h-mpf8-25gj", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module could install with richtext in its description field which could contain scripts that will run for user in the Persona Bar. Versions 9.13.10 and 10.2.0 contain a fix for the issue."}, {"lang": "es", "value": "DNN (anteriormente DotNetNuke) es una plataforma de gesti\u00f3n de contenido web (CMS) de c\u00f3digo abierto en el ecosistema de Microsoft. Antes de las versiones 9.13.10 y 10.2.0, un m\u00f3dulo pod\u00eda instalarse con texto enriquecido en su campo de descripci\u00f3n, el cual pod\u00eda contener scripts que se ejecutar\u00edan para el usuario en la Barra Persona. Las versiones 9.13.10 y 10.2.0 contienen una soluci\u00f3n para el problema."}], "lastModified": "2026-06-17T10:23:40.303", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44A2C358-234E-40C4-BC42-942B1E8CB6BB", "versionEndExcluding": "9.13.10"}, {"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "183DA3B3-D5F9-4C05-93A3-4B17DE048679", "versionEndExcluding": "10.2.0", "versionStartIncluding": "10.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}