GHSA-wwc9-wmm3-2pmfMediumCVSS 5.4

DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

Published
June 20, 2025
Last Modified
September 15, 2025

🔗 CVE IDs covered (1)

CVE-2025-52485 →

📋 Description

DNN.PLATFORM allows a specially crafted request can inject scripts in the Activity Feed Attachments endpoint which will then render in the feed, resulting in a cross-site scripting attack. This vulnerability is fixed in 10.0.1.

🎯 Affected products1

  • nuget/DNN.PLATFORM:>= 6.0.0, < 10.0.1

🔗 References (3)