CVE-2025-52486
BaseFortify
Publication date: 2025-06-21
Last updated on: 2025-09-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dnnsoftware | dotnetnuke | From 6.0.0 (inc) to 10.0.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts in the browsers of users who interact with crafted URLs. While it does not directly affect system confidentiality, integrity, or availability, it can lead to the exposure of sensitive information (high confidentiality impact) through the injected scripts. Exploitation requires no privileges but does require user interaction. [1]
Can you explain this vulnerability to me?
CVE-2025-52486 is a reflected Cross-Site Scripting (XSS) vulnerability in the DNN.Platform content management system. It occurs because specially crafted content in URLs is processed by the TokenReplace feature along with certain SkinObjects without proper sanitization. This allows attackers to inject malicious scripts that are reflected back to users, potentially executing in their browsers. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for reflected Cross-Site Scripting (XSS) attempts involving specially crafted URLs targeting the TokenReplace feature in DNN.Platform versions 6.0.0 to before 10.0.1. Detection involves observing HTTP requests with suspicious or malicious script content in URL parameters that are reflected back in responses. While no specific commands are provided, typical detection methods include using web application firewalls (WAF) with XSS detection rules, inspecting server logs for unusual URL patterns, and employing security scanners that test for reflected XSS vulnerabilities by sending crafted payloads and analyzing responses. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the DNN.Platform to version 10.0.1 or later, where the vulnerability has been patched by introducing context-aware encoding of token outputs to prevent XSS. If upgrading is not immediately possible, applying strict input validation and output encoding on URL parameters processed by TokenReplace and SkinObjects can help reduce risk. Additionally, configuring web application firewalls to block or sanitize malicious URL inputs and educating users to avoid interacting with suspicious URLs can mitigate exploitation. [1, 2]