GHSA-gj8m-5492-q98h

Source

https://github.com/advisories/GHSA-gj8m-5492-q98h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-gj8m-5492-q98h/GHSA-gj8m-5492-q98h.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-gj8m-5492-q98h

Aliases

CVE-2025-59546

Published

2025-09-23T15:09:39Z

Modified

2025-09-23T19:37:46.244120Z

Severity

2.4 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Summary

DNN Vulnerable to Stored XSS Using Backend Admin Credentials

Details

Summary

Users that can edit modules could set a title that includes scripts.

Description

Some users (administrators and content editors) can set html in module titles and that could include javascript which could be used for XSS based attacks. With the addition of more roles being able to set module titles, this is not strictly limited to administrators. However since HTML in module titles could be a valid use case, we have added a setting for this functionality in the Security module in the Persona Bar.

Database specific

{
    "severity": "LOW",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed_at": "2025-09-23T15:09:39Z",
    "nvd_published_at": "2025-09-23T18:15:39Z"
}

References

Affected packages

NuGet / DotNetNuke.Core

Package

Name: DotNetNuke.Core; View open source insights on deps.dev
Purl: pkg:nuget/DotNetNuke.Core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

10.1.0

Affected versions

6.*

6.0.0

7.*

7.0.0

7.0.6.121

7.1.0

7.1.2

7.2.0.613

7.3.0.499

7.3.1.20

7.4.0.353

7.4.1.280

7.4.2.216

8.*

8.0.0.809

8.0.1.239

8.0.2.4

8.0.3.5

8.0.4.226

9.*

9.0.0.1002

9.0.1.142

9.1.0.367

9.1.1.129

9.2.0.366

9.2.1.533

9.3.0

9.3.1

9.3.2

9.4.0

9.4.1

9.4.2

9.4.3

9.4.4

9.5.0

9.6.1

9.6.2

9.7.0

9.7.1

9.7.2

9.8.0

9.9.0

9.9.1

9.10.0

9.10.1

9.10.2

9.11.0

9.11.1

9.11.2

9.12.0

9.13.0-ci0000

9.13.0

9.13.1

9.13.2

9.13.3

9.13.4

9.13.5-ci0062

9.13.5

9.13.6

9.13.7-ci0064

9.13.7

9.13.8

9.13.9

10.*

10.0.0

10.0.1