CVE-2026-24836

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.0 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2g5g-hcgh-q3rp	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dnnsoftware:dotnetnuke::::::::
	cpe:2.3:a:dnnsoftware:dotnetnuke::::::::

History

17 Jun 2026, 10:23

Type	Values Removed	Values Added
Summary		(es) DNN (anteriormente DotNetNuke) es una plataforma de gestión de contenido web de código abierto (CMS) en el ecosistema de Microsoft. A partir de la versión 9.0.0 y anterior a las versiones 9.13.10 y 10.2.0, las extensiones podían escribir texto enriquecido en las notas de registro, que pueden incluir scripts que se ejecutarían en la PersonaBar al mostrarse. Las versiones 9.13.10 y 10.2.0 contienen una solución para el problema.

04 Feb 2026, 20:11

Type	Values Removed	Values Added
References	~~() https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2g5g-hcgh-q3rp -~~	() https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2g5g-hcgh-q3rp - Vendor Advisory
CPE		cpe:2.3:a:dnnsoftware:dotnetnuke::::::::
First Time		Dnnsoftware dotnetnuke Dnnsoftware

28 Jan 2026, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-28 00:15

Updated : 2026-06-17 10:23

NVD link : CVE-2026-24836

Mitre link : CVE-2026-24836

CVE.ORG link : CVE-2026-24836

JSON object : View

Products Affected

dnnsoftware

dotnetnuke

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-24836", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24836", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-28T21:04:00.728156Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dnnsoftware", "product": "Dnn.Platform", "versions": [{"status": "affected", "version": ">= 9.0.0, < 9.13.10"}, {"status": "affected", "version": ">= 10.0.0, < 10.2.0"}]}]}], "published": "2026-01-28T00:15:50.910", "references": [{"url": "https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2g5g-hcgh-q3rp", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed. Versions 9.13.10 and 10.2.0 contain a fix for the issue."}, {"lang": "es", "value": "DNN (anteriormente DotNetNuke) es una plataforma de gesti\u00f3n de contenido web de c\u00f3digo abierto (CMS) en el ecosistema de Microsoft. A partir de la versi\u00f3n 9.0.0 y anterior a las versiones 9.13.10 y 10.2.0, las extensiones pod\u00edan escribir texto enriquecido en las notas de registro, que pueden incluir scripts que se ejecutar\u00edan en la PersonaBar al mostrarse. Las versiones 9.13.10 y 10.2.0 contienen una soluci\u00f3n para el problema."}], "lastModified": "2026-06-17T10:23:40.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "702DB18F-9415-4782-97AD-BE8BB66C7D47", "versionEndExcluding": "9.13.10", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "183DA3B3-D5F9-4C05-93A3-4B17DE048679", "versionEndExcluding": "10.2.0", "versionStartIncluding": "10.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}