CVE-2026-24838
Critical · 9.1CVSS
9.1
EPSS
0.2%
Published
Jan 28, 2026
CISA due date
—
The record
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| NuGet | DotNetNuke.Core | 0 | 9.13.10 |
| NuGet | DotNetNuke.Core | 10.0.0 | 10.2.0 |
| nuget | DotNetNuke.Core | 10.0.0 | 10.2.0 |
Related vulnerabilities
- GHSA-w9pf-h6m6-v89h DotNetNuke.Core Vulnerable to Stored XSS via Module Title Same vulnerability
- GHSA-vm5q-8qww-h238 DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal Also affects DotNetNuke.Core
- GHSA-2g5g-hcgh-q3rp DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes Also affects DotNetNuke.Core
- GHSA-jjwg-4948-6wxp DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer Also affects DotNetNuke.Core
- CVE-2026-24837 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the… Also affects DotNetNuke.Core
- CVE-2026-24784 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the… Also affects DotNetNuke.Core
- CVE-2026-24836 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the… Also affects DotNetNuke.Core
- GHSA-hmvq-8p83-cq52 DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload Also affects DotNetNuke.Core