{"id":"GHSA-ffq7-898w-9jc4","revision":null,"records":[{"revision":"442f7c28cb17478a98b9cb42958b8102","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-40321","aliases":[],"title":"DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.","state":0,"publishedAt":"2026-04-17T21:10:33.192+00:00","modifiedAt":"2026-04-22T03:55:44.141+00:00","affected":[{"ecosystem":"Vendor product","name":"Dnn.Platform","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"dnnsoftware\",\n                    \"product\": \"Dnn.Platform\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 10.2.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-ffq7-898w-9jc4","https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-40321","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-40321","identifiers":["CVE-2026-40321"]},"retained":false,"historicalAffected":[]},{"revision":"1fb4a86f0b844b39ab37211c0113d943","observedAt":"2026-11-01T06:16:26.289+00:00","statement":{"source":"euvd","id":"EUVD-2026-24061","aliases":["CVE-2026-40321"],"title":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenti…","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","score":8.1,"severity":null}],"references":["https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-ffq7-898w-9jc4","https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24061","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 17, 2026, 9:10:33 PM","dateUpdated":"Apr 22, 2026, 3:55:44 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-24061","identifiers":["EUVD-2026-24061","CVE-2026-40321"]},"retained":false,"historicalAffected":[]},{"revision":"d3d7b43f44ae4389aff2079e4a02b594","observedAt":"2026-10-27T10:09:56.341+00:00","statement":{"source":"nvd","id":"CVE-2026-40321","aliases":[],"title":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenti…","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.","state":0,"publishedAt":"2026-04-17T22:16:32.653+00:00","modifiedAt":"2026-10-26T22:10:00.163+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","score":8,"severity":"HIGH"}],"references":["https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2","https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-ffq7-898w-9jc4"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40321","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-87"],"productCriteria":["cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-17T22:16:32.653","lastModified":"2026-10-26T22:10:00.163"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-40321","identifiers":["CVE-2026-40321"]},"retained":false,"historicalAffected":[]},{"revision":"f2c1499b73ac4eb3962be6faa4ecdc2a","observedAt":"2026-10-23T16:01:25.029+00:00","statement":{"source":"osv","id":"GHSA-ffq7-898w-9jc4","aliases":["CVE-2026-40321"],"title":"DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.","state":0,"publishedAt":"2026-04-10T20:42:48+00:00","modifiedAt":"2026-05-05T16:06:30.053743+00:00","affected":[{"ecosystem":"NuGet","name":"DotNetNuke.Core","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"10.2.2"}]}],"versions":["10.0.0","10.0.1","10.1.0","10.1.1","10.1.2","10.2.0","10.2.1","6.0.0","7.0.0","7.0.6.121","7.1.0","7.1.2","7.2.0.613","7.3.0.499","7.3.1.20","7.4.0.353","7.4.1.280","7.4.2.216","8.0.0.809","8.0.1.239","8.0.2.4","8.0.3.5","8.0.4.226","9.0.0.1002","9.0.1.142","9.1.0.367","9.1.1.129","9.10.0","9.10.1","9.10.2","9.11.0","9.11.1","9.11.2","9.12.0","9.13.0","9.13.0-ci0000","9.13.1","9.13.2","9.13.3","9.13.4","9.13.5","9.13.5-ci0062","9.13.6","9.13.7","9.13.7-ci0064","9.13.8","9.13.9","9.2.0.366","9.2.1.533","9.3.0","9.3.1","9.3.2","9.4.0","9.4.1","9.4.2","9.4.3","9.4.4","9.5.0","9.6.1","9.6.2","9.7.0","9.7.1","9.7.2","9.8.0","9.9.0","9.9.1"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-ffq7-898w-9jc4","https://nvd.nist.gov/vuln/detail/CVE-2026-40321","https://github.com/dnnsoftware/Dnn.Platform","https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2"],"sourceUrl":"https://github.com/advisories/GHSA-ffq7-898w-9jc4","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-ffq7-898w-9jc4","identifiers":["GHSA-ffq7-898w-9jc4","CVE-2026-40321"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-02T17:59:09.2434258+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-02T17:59:09.2434258+00:00","lastSuccessAt":"2026-11-02T17:59:09.390895+00:00","error":null,"lastVerifiedAt":"2026-11-02T17:59:09.3908952+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-37087f5ac35d6d996bd0480d4228062695465d95096b336bdfd509d8efa3a1e5-633068e59877a6937e130d0731af157ba37ca5256f0d98c60665b5615da2da08","complete":true,"records":417957,"lastAttemptAt":"2026-11-02T17:57:21.7537179+00:00","lastSuccessAt":"2026-11-02T17:57:21.6683395+00:00","error":null,"lastVerifiedAt":"2026-11-02T17:57:21.7537179+00:00","snapshotPublishedAt":"2026-11-02T17:26:49+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3afbfcfae1fe455bbc5a5006f95b2df4","complete":true,"records":13568,"lastAttemptAt":"2026-11-02T17:59:35.6307793+00:00","lastSuccessAt":"2026-11-02T11:59:30.621+00:00","error":null,"lastVerifiedAt":"2026-11-02T11:59:30.621+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-02T17:59:09.2434258+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-02T17:59:09.2434258+00:00","lastSuccessAt":"2026-11-02T17:59:09.3916305+00:00","error":null,"lastVerifiedAt":"2026-11-02T17:59:09.3916306+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3f09b4feb4c94572b88c786937978587","complete":true,"records":13580,"lastAttemptAt":"2026-11-02T17:59:34.9671025+00:00","lastSuccessAt":"2026-11-02T17:59:34.964+00:00","error":null,"lastVerifiedAt":"2026-11-02T17:59:34.964+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-02T17:59:09.1852157+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-02T17:59:09.1852157+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-02T17:57:21.9161099+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-02T17:57:21.9161099+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-5eac0f41c5234939771ec81ee6dcecba911c3ba21e363f4cecd95fcede18b96b","complete":true,"records":3035,"lastAttemptAt":"2026-11-02T17:59:09.2000247+00:00","lastSuccessAt":"2026-11-02T13:57:36.6498985+00:00","error":null,"lastVerifiedAt":"2026-11-02T17:59:09.2000247+00:00","snapshotPublishedAt":"2026-11-02T12:18:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-feb03b7d7d7824263abb3fb73d0cbd5ec387926240a25511ab5ed6512e00f46f","complete":true,"records":231039,"lastAttemptAt":"2026-11-02T17:59:09.0416863+00:00","lastSuccessAt":"2026-11-02T17:59:07.6213478+00:00","error":null,"lastVerifiedAt":"2026-11-02T17:59:09.0416863+00:00","snapshotPublishedAt":"2026-11-02T17:33:45+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}