{"id":"EUVD-2025-30894","enisaUuid":"93301d80-bbe9-3358-bd16-ee7a81419da5","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. In these cases, the application does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim’s browser to interpret attacker-controlled content as part of the page’s HTML. This issue has been patched in version 10.1.0.","datePublished":"Sep 23, 2025, 5:42:17 PM","dateUpdated":"Sep 23, 2025, 6:37:15 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-jc4g-c8ww-5738\n","aliases":"CVE-2025-59821\nGHSA-jc4g-c8ww-5738\n","assigner":"GitHub_M","epss":0.21,"enisaIdProduct":[{"id":"f3dceb0e-319a-38d7-a3dd-fd65b07286cb","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"\u003c 10.1.0"}],"enisaIdVendor":[{"id":"a81b2977-5304-3608-bd1a-27cf8490842a","vendor":{"name":"DNNSoftware"}},{"id":"d722422f-f177-39a9-b7cd-598c384605b5","vendor":{"name":"DNNSoftware"}}],"enisaIdVulnerability":[{"id":"e6bf21f0-fc89-3eaa-b545-45c99b173ead","vulnerability":{"id":"GHSA-jc4g-c8ww-5738","description":"DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile","datePublished":"Sep 23, 2025, 3:09:47 PM","dateUpdated":"Sep 23, 2025, 7:13:33 PM","baseScore":0.0,"references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-jc4g-c8ww-5738\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59821\nhttps://github.com/dnnsoftware/Dnn.Platform\n","enisa_id":"EUVD-2025-30894\n","aliases":"GHSA-jc4g-c8ww-5738\nCVE-2025-59821\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:13:00 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"eb2816bc-266f-3711-8bdb-1bc4fd50faf1","vulnerability":{"id":"CVE-2025-59821","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. In these cases, the application does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim’s browser to interpret attacker-controlled content as part of the page’s HTML. This issue has been patched in version 10.1.0.","datePublished":"Sep 23, 2025, 5:42:17 PM","dateUpdated":"Sep 23, 2025, 6:37:15 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-jc4g-c8ww-5738\n","enisa_id":"EUVD-2025-30894\n","assigner":"GitHub_M","epss":0.21,"dataProcessed":"Nov 4, 2026, 7:13:38 AM","vulnerabilityProduct":[{"id":"69e9e899-0308-4115-a4fd-d621e1ab6ffe","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"\u003c 10.1.0"},{"id":"9f73a7fb-f615-3876-b424-6976749dd986","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"\u003c 10.1.0"}],"vulnerabilityVendor":[{"id":"299cbb67-beaa-3fe2-a4f5-876ffbe80cbb","vendor":{"name":"DNNSoftware"}},{"id":"7d7dadf2-574d-31d3-b616-f0309148cade","vendor":{"name":"DNNSoftware"}}]}}],"enisaIdAdvisory":[]}