CVE-2025-52486 (Medium) detected in DotNetNuke-9.9.0.0.dll

[mend-bolt-for-github]

CVE-2025-52486 - Medium Severity Vulnerability

Vulnerable Library - DotNetNuke-9.9.0.0.dll

DotNetNuke

Library home page: https://api.nuget.org/packages/dotnetnuke.core.9.9.0.nupkg

Path to vulnerable library: /Modules/PageSettingsEditor/packages/DotNetNuke.Core.9.9.0/lib/net45/DotNetNuke.dll

Dependency Hierarchy:

• ❌ DotNetNuke-9.9.0.0.dll (Vulnerable Library)

Found in HEAD commit: 8727e4bba1fb8bb6a2721c00a891d080c7f11b90

Found in base branch: main

Vulnerability Details

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows specially crafted content in URLs to be used with TokenReplace and not be properly sanitized by some SkinObjects. This issue has been patched in version 10.0.1.

Publish Date: 2025-06-21

URL: CVE-2025-52486

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with Mend here