~ / search / GHSA-m4hf-fxcg-cp34

GHSA-m4hf-fxcg-cp34

DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-48378

Packages

EcosystemPackageAffectedFixed in
NuGet DotNetNuke.Core < 9.13.9 9.13.9

Details

As written in the advisory (Markdown source, shown as plain text).

Uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks.

References

External links from the advisory. They lead to third-party sites.