{"id":"CVE-2025-59535","sourceIdentifier":"security-advisories@github.com","published":"2025-09-22T21:16:00.287","lastModified":"2026-10-11T20:10:00.200","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0."},{"lang":"es","value":"DNN (anteriormente DotNetNuke) es una plataforma de gestión de contenido web de código abierto (CMS) en el ecosistema de Microsoft. Antes de la versión 10.1.0, se podían cargar temas arbitrarios a través de parámetros de consulta. Si un tema instalado tenía una vulnerabilidad, incluso si no se utilizaba en ninguna página, este podía cargarse en clientes desprevenidos sin el conocimiento del propietario del sitio. Este problema ha sido parcheado en la versión 10.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"dnnsoftware","product":"Dnn.Platform","versions":[{"version":"< 10.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-09-23T20:08:12.218664Z","id":"CVE-2025-59535","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-829"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*","versionEndExcluding":"10.1.0","matchCriteriaId":"01D7C117-D981-49F3-B3E1-963FBB5ED1C2"}]}]}],"references":[{"url":"https://github.com/dnnsoftware/Dnn.Platform/blob/develop/DNN%20Platform/Library/UI/Skins/Skin.cs#L305","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://github.com/dnnsoftware/Dnn.Platform/commit/72f30f69fd2214d77f6c2577dfcca495a24caf5c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-wq2j-w9pm-7x2p","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}