{"id":"EUVD-2025-30448","enisaUuid":"f0e338e7-dc09-34d1-8d4b-d13affe9490e","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.","datePublished":"Sep 22, 2025, 8:59:03 PM","dateUpdated":"Sep 23, 2025, 8:12:28 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-wq2j-w9pm-7x2p\nhttps://github.com/dnnsoftware/Dnn.Platform/commit/72f30f69fd2214d77f6c2577dfcca495a24caf5c\nhttps://github.com/dnnsoftware/Dnn.Platform/blob/develop/DNN%20Platform/Library/UI/Skins/Skin.cs#L305\n","aliases":"CVE-2025-59535\nGHSA-wq2j-w9pm-7x2p\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"263c1179-ab49-3155-8e6e-6c24baf3b390","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"\u003c 10.1.0"}],"enisaIdVendor":[{"id":"074b4fae-6408-38fe-9d40-c56abb4d4b6c","vendor":{"name":"DNNSoftware"}},{"id":"0fb5b1eb-ee63-3f49-9972-425c880d4cd8","vendor":{"name":"DNNSoftware"}}],"enisaIdVulnerability":[{"id":"a2a2009a-3143-3840-96f2-3b8c604ad558","vulnerability":{"id":"GHSA-wq2j-w9pm-7x2p","description":"DNN allows loading unused themes on anonymous clients through query parameters","datePublished":"Sep 22, 2025, 9:10:20 PM","dateUpdated":"Sep 22, 2025, 9:59:35 PM","baseScore":0.0,"references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-wq2j-w9pm-7x2p\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59535\nhttps://github.com/dnnsoftware/Dnn.Platform/commit/72f30f69fd2214d77f6c2577dfcca495a24caf5c\nhttps://dnncommunity.org/?SkinSrc\u003d%5BG%5Dskins%2Fxcillion%2Fhome\u0026ContainerSrc\u003d%5BG%5DContainers%2FXcillion%2FNoTitle\nhttps://github.com/dnnsoftware/Dnn.Platform\nhttps://github.com/dnnsoftware/Dnn.Platform/blob/develop/DNN%20Platform/Library/UI/Skins/Skin.cs#L305\n","enisa_id":"EUVD-2025-30448\n","aliases":"CVE-2025-59535\nGHSA-wq2j-w9pm-7x2p\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:13:00 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"df0f68f3-ad69-3edb-be0f-25a117658273","vulnerability":{"id":"CVE-2025-59535","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.","datePublished":"Sep 22, 2025, 8:59:03 PM","dateUpdated":"Sep 23, 2025, 8:12:28 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-wq2j-w9pm-7x2p\nhttps://github.com/dnnsoftware/Dnn.Platform/commit/72f30f69fd2214d77f6c2577dfcca495a24caf5c\nhttps://github.com/dnnsoftware/Dnn.Platform/blob/develop/DNN%20Platform/Library/UI/Skins/Skin.cs#L305\n","enisa_id":"EUVD-2025-30448\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Oct 29, 2026, 7:13:55 AM","vulnerabilityProduct":[{"id":"2d36d7b5-c198-4404-9276-82a0ac381f20","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"\u003c 10.1.0"},{"id":"f8be9516-917d-3132-ba27-9cba4e49a2c2","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"\u003c 10.1.0"}],"vulnerabilityVendor":[{"id":"12578aae-325f-36f8-9b2a-81499258a640","vendor":{"name":"DNNSoftware"}},{"id":"265f0952-17f6-3713-9a63-0aab32b4f87d","vendor":{"name":"DNNSoftware"}}]}}],"enisaIdAdvisory":[]}