1. Home
  2. CVE Database
  3. CVE-2025-59539
MEDIUM · 6.3

CVE-2025-59539

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that f...

Vulnerability Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0.

CVSS Score

6.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
DnnsoftwareDotnetnuke< 10.1.0

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2025-59539?

CVE-2025-59539 is a vulnerability with a CVSS score of 6.3 (MEDIUM). DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that f...

How severe is CVE-2025-59539?

CVE-2025-59539 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-59539?

Check the references section above for vendor advisories and patch information. Affected products include: Dnnsoftware Dotnetnuke.