GHSA-pf4h-vrv6-cmvr

DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-52486

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	DNN.PLATFORM	>= 6.0.0, < 10.0.1	10.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

DNN.PLATFORM allows specially crafted content in URLs could be used with TokenReplace and not be properly sanitized by some SkinObjects. This vulnerability is fixed in 10.0.1.

References

External links from the advisory. They lead to third-party sites.

https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-pf4h-vrv6-cmvr web
https://nvd.nist.gov/vuln/detail/CVE-2025-52486 advisory
https://github.com/dnnsoftware/Dnn.Platform/commit/74f6de68da1572c1d7e9c6e30e9f77f7c5596b1b web
https://github.com/dnnsoftware/Dnn.Platform package