CVE-2026-24784
Medium · 6.8CVSS
6.8
EPSS
0.2%
Published
Jan 28, 2026
CISA due date
—
The record
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a content editor could inject scripts in module headers/footers that would run for other users. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| NuGet | DotNetNuke.Core | 10.0.0 | 10.2.0 |
| NuGet | DotNetNuke.Core | 9.0.0 | 9.13.10 |
| nuget | DotNetNuke.Core | 10.0.0 | 10.2.0 |
| nuget | DotNetNuke.Core | 9.0.0 | 9.13.10 |
Related vulnerabilities
- GHSA-jjwg-4948-6wxp DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer Same vulnerability
- GHSA-w9pf-h6m6-v89h DotNetNuke.Core Vulnerable to Stored XSS via Module Title Also affects DotNetNuke.Core
- GHSA-vm5q-8qww-h238 DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal Also affects DotNetNuke.Core
- GHSA-2g5g-hcgh-q3rp DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes Also affects DotNetNuke.Core
- CVE-2026-24838 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the… Also affects DotNetNuke.Core
- CVE-2026-24837 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the… Also affects DotNetNuke.Core
- CVE-2026-24836 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the… Also affects DotNetNuke.Core
- GHSA-hmvq-8p83-cq52 DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload Also affects DotNetNuke.Core