~ / search / GHSA-7rcc-q6rq-jpcm

GHSA-7rcc-q6rq-jpcm

DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-59539

Packages

EcosystemPackageAffectedFixed in
NuGet DotNetNuke.Core < 10.1.0 10.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary Users can use special syntax to inject javascript code in their profile biography field. Although there was sanitization in place, it did not cover all possible scenarios ## Description When embedding information in the `Biography` field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers.

References

External links from the advisory. They lead to third-party sites.