{"id":"EUVD-2025-36566","enisaUuid":"93ab7121-30db-390f-915c-35d2f7ec6179","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.","datePublished":"Oct 28, 2025, 9:42:07 PM","dateUpdated":"Oct 29, 2025, 2:53:52 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2374-6cvw-qmx6\n","aliases":"CVE-2025-62802\nGHSA-2374-6cvw-qmx6\n","assigner":"GitHub_M","epss":0.23,"enisaIdProduct":[{"id":"dae24478-a497-36a5-8c92-56ecdb0b7974","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"\u003c 10.1.1"}],"enisaIdVendor":[{"id":"8ed6bc4f-f973-33dc-9254-448ba039d13b","vendor":{"name":"DNNSoftware"}}],"enisaIdVulnerability":[{"id":"171a2a0a-3cac-330d-b046-9f98256d7945","vulnerability":{"id":"GHSA-2374-6cvw-qmx6","description":"DNN CKEditor Provider allows unauthenticated upload out-of-the-box","datePublished":"Oct 29, 2025, 9:44:28 PM","dateUpdated":"Oct 29, 2025, 9:44:28 PM","baseScore":0.0,"references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2374-6cvw-qmx6\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-62802\nhttps://github.com/dnnsoftware/Dnn.Platform/commit/6497d3c35217e6e62e50d3ed7c8809eb69e3d06b\nhttps://github.com/dnnsoftware/Dnn.Platform\n","enisa_id":"EUVD-2025-36566\n","aliases":"GHSA-2374-6cvw-qmx6\nCVE-2025-62802\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"5c35869e-167d-3cb2-a85c-e3de455b3436","vulnerability":{"id":"CVE-2025-62802","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.","datePublished":"Oct 28, 2025, 9:42:07 PM","dateUpdated":"Oct 29, 2025, 2:53:52 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2374-6cvw-qmx6\n","enisa_id":"EUVD-2025-36566\n","assigner":"GitHub_M","epss":0.23,"dataProcessed":"Oct 27, 2026, 7:20:03 AM","vulnerabilityProduct":[{"id":"121e7dd1-1654-359f-a0b9-fc94f14ddad1","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"\u003c 10.1.1"}],"vulnerabilityVendor":[{"id":"aaff1198-0038-36a5-9619-46ad0a3e7a88","vendor":{"name":"DNNSoftware"}}]}}],"enisaIdAdvisory":[]}