{"id":"EUVD-2025-30452","enisaUuid":"29768b85-c8d8-344d-8246-b4e06838ec42","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0.","datePublished":"Sep 23, 2025, 5:41:01 PM","dateUpdated":"Sep 23, 2025, 6:37:32 PM","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-7rcc-q6rq-jpcm\n","aliases":"CVE-2025-59539\nGHSA-7rcc-q6rq-jpcm\n","assigner":"GitHub_M","epss":0.18,"enisaIdProduct":[{"id":"b3acdec4-ddb7-36df-8353-eeaa9b554acb","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"\u003c 10.1.0"}],"enisaIdVendor":[{"id":"437f1626-e0cb-307f-98b5-0699f358e9c7","vendor":{"name":"DNNSoftware"}},{"id":"4644e27c-3e84-3e6b-add7-81bd1c07bfe7","vendor":{"name":"DNNSoftware"}}],"enisaIdVulnerability":[{"id":"18c8da38-a455-38e5-9106-f1809d183095","vulnerability":{"id":"GHSA-7rcc-q6rq-jpcm","description":"DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field","datePublished":"Sep 22, 2025, 9:51:04 PM","dateUpdated":"Sep 23, 2025, 7:13:11 PM","baseScore":0.0,"references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-7rcc-q6rq-jpcm\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59539\nhttps://github.com/dnnsoftware/Dnn.Platform\n","enisa_id":"EUVD-2025-30452\n","aliases":"CVE-2025-59539\nGHSA-7rcc-q6rq-jpcm\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:13:00 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"2f4c8530-336b-3e99-ab1f-317829e0f490","vulnerability":{"id":"CVE-2025-59539","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0.","datePublished":"Sep 23, 2025, 5:41:01 PM","dateUpdated":"Sep 23, 2025, 6:37:32 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-7rcc-q6rq-jpcm\n","enisa_id":"EUVD-2025-30452\n","assigner":"GitHub_M","epss":0.18,"dataProcessed":"Oct 29, 2026, 7:13:55 AM","vulnerabilityProduct":[{"id":"559b40b7-d06e-4b2b-a26d-9c00aebe967d","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"\u003c 10.1.0"},{"id":"5fdc6131-86fb-3dc7-8a76-b18c5e6b48aa","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"\u003c 10.1.0"}],"vulnerabilityVendor":[{"id":"34c569e9-63e9-34c4-8769-b4066b4226b1","vendor":{"name":"DNNSoftware"}},{"id":"ba39720d-922b-34ee-afd1-e704fcfc5dd8","vendor":{"name":"DNNSoftware"}}]}}],"enisaIdAdvisory":[]}