CVE-2025-48378

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-48378
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48378.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-48378
Aliases
Published
2025-05-23T15:39:03.727Z
Modified
2026-04-10T05:28:15.450644Z
Severity
  • 6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline
Details

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48378.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/dnnsoftware/dnn.platform

Affected ranges

Type
GIT
Repo
https://github.com/dnnsoftware/dnn.platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8fad43c3dbfdc3f6e66625424e164a72be64a3cf

Affected versions

v9.*
v9.1.0
v9.10.0-rc1
v9.10.1-rc1
v9.11.0-rc4
v9.11.1-rc1
v9.11.2
v9.11.2-rc1
v9.12.0-rc1
v9.13.0-rc1
v9.13.0-rc3
v9.13.2-rc1
v9.13.4-rc1
v9.13.5-rc1
v9.13.6-rc1
v9.13.7-rc1
v9.13.8-rc1
v9.3.0-rc0
v9.3.0-rc1
v9.4.0
v9.4.0-rc0
v9.4.0-rc1
v9.4.1
v9.4.1-rc1
v9.4.2
v9.4.2-rc1
v9.4.3
v9.4.3-rc1
v9.5.0-rc1
v9.6.0-rc1
v9.8.0-rc1
v9.8.1-rc1
v9.9.1-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48378.json"