Medium severity6.4NVD Advisory· Published Oct 28, 2025· Updated Jun 17, 2026

CVE-2025-64094

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios. This vulnerability exists because of an incomplete fix for CVE-2025-48378. This vulnerability is fixed in 10.1.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
DotNetNuke.CoreNuGet	< 10.1.1	10.1.1

Affected products

Dnnsoftware/Dotnetnuke
cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*
Range: <10.1.1
ghsa-coords
pkg:nuget/dotnetnuke.core
Range: < 10.1.1
Dnnsoftware/Dnn.platformv5
Range: < 10.1.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-hmvq-8p83-cq52ghsaADVISORY
github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-hmvq-8p83-cq52nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2025-64094ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000