CVE-2025-64095

Published Oct 28, 2025

Last updated 6 days ago

DNN

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-64095 is a vulnerability found in DNN (formerly DotNetNuke), which is an open-source web content management platform. Prior to version 10.1.1, the default HTML editor provider allows unauthenticated file uploads, and images can overwrite existing files. This means an unauthenticated user could upload files and replace existing ones, potentially defacing a website. This vulnerability could also be combined with other issues to inject cross-site scripting (XSS) payloads. The vulnerability is fixed in version 10.1.1 of DNN.

Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1.
Source: security-advisories@github.com
NVD status: Analyzed
Products: dotnetnuke

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-434

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AADA05D8-5532-4750-85C9-7B6F25E3BFD7",
            "versionEndExcluding": "10.1.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.