{"id":"CVE-2025-59545","sourceIdentifier":"security-advisories@github.com","published":"2025-09-23T18:15:38.953","lastModified":"2026-10-11T20:10:00.200","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution (XSS). This issue has been patched in version 10.1.0."},{"lang":"es","value":"DNN (anteriormente DotNetNuke) es una plataforma de gestión de contenido web de código abierto (CMS) en el ecosistema de Microsoft. Antes de la versión 10.1.0, el módulo Prompt permite la ejecución de comandos que pueden devolver HTML sin procesar. La entrada maliciosa, incluso si se ha saneado para su visualización en otro lugar, puede ejecutarse cuando se procesa a través de ciertos comandos, lo que lleva a una posible ejecución de scripts (XSS). Este problema ha sido parcheado en la versión 10.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"dnnsoftware","product":"Dnn.Platform","versions":[{"version":"< 10.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-09-23T18:30:12.333507Z","id":"CVE-2025-59545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*","versionEndExcluding":"10.1.0","matchCriteriaId":"01D7C117-D981-49F3-B3E1-963FBB5ED1C2"}]}]}],"references":[{"url":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2qxc-mf4x-wr29","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}