{"id":"EUVD-2026-24061","enisaUuid":"0ed9882f-f727-3d65-b96a-d5b0c189640d","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.","datePublished":"Apr 17, 2026, 9:10:33 PM","dateUpdated":"Apr 22, 2026, 3:55:44 AM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-ffq7-898w-9jc4\nhttps://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2\n","aliases":"CVE-2026-40321\n","assigner":"GitHub_M","epss":6.41,"enisaIdProduct":[{"id":"b2593f0c-7787-37ce-ad20-caf94b182ce9","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"\u003c 10.2.2"}],"enisaIdVendor":[{"id":"abcf1805-4e1b-39a5-b557-78bddc6e8b61","vendor":{"name":"DNNSoftware"}}],"enisaIdVulnerability":[{"id":"80142950-81c0-3662-99e2-411ffa206b68","vulnerability":{"id":"GHSA-ffq7-898w-9jc4","description":"DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload","datePublished":"Apr 10, 2026, 8:42:48 PM","dateUpdated":"Apr 24, 2026, 8:50:37 PM","baseScore":0.0,"references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-ffq7-898w-9jc4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40321\nhttps://github.com/dnnsoftware/Dnn.Platform\nhttps://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2\n","enisa_id":"EUVD-2026-24061\n","aliases":"GHSA-ffq7-898w-9jc4\nCVE-2026-40321\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9b19892c-571e-3934-b91b-457cf1b0bd6e","vulnerability":{"id":"CVE-2026-40321","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.","datePublished":"Apr 17, 2026, 9:10:33 PM","dateUpdated":"Apr 22, 2026, 3:55:44 AM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-ffq7-898w-9jc4\nhttps://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2\n","enisa_id":"EUVD-2026-24061\n","assigner":"GitHub_M","epss":6.41,"dataProcessed":"Nov 1, 2026, 7:17:12 AM","vulnerabilityProduct":[{"id":"8af4aeeb-668d-370d-ae33-b2b5c50a584f","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"\u003c 10.2.2"}],"vulnerabilityVendor":[{"id":"6b3e5b2a-15d0-330e-9ef7-8a2184e01369","vendor":{"name":"DNNSoftware"}}]}}],"enisaIdAdvisory":[]}