CVE-2025-59535

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59535
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59535.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-59535
Aliases
Published
2025-09-22T20:59:03Z
Modified
2026-10-21T02:30:32Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
DotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters
Details

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-20",
        "CWE-200",
        "CWE-829"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59535.json"
}
References

Affected packages

Git / github.com/dnnsoftware/dnn.platform

Affected ranges

Type
GIT
Repo
https://github.com/dnnsoftware/dnn.platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f66ba091c1d9361bbe961801c18b9e951c436c41
Fixed
72f30f69fd2214d77f6c2577dfcca495a24caf5c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "10.1.0"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "72f30f69fd2214d77f6c2577dfcca495a24caf5c"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v10.*
v10.0.0
v10.0.1
v10.0.1-rc1
v9.*
v9.1.0
v9.10.0
v9.10.0-rc1
v9.10.1
v9.10.1-rc1
v9.10.2
v9.11.0
v9.11.0-rc4
v9.11.1
v9.11.1-rc1
v9.11.2
v9.11.2-rc1
v9.12.0
v9.12.0-rc1
v9.13.0
v9.13.0-rc1
v9.13.0-rc3
v9.13.1
v9.13.2
v9.13.2-rc1
v9.13.3
v9.13.4
v9.13.4-rc1
v9.13.5
v9.13.5-rc1
v9.13.6
v9.13.6-rc1
v9.13.7
v9.13.7-rc1
v9.13.8
v9.13.8-rc1
v9.13.9
v9.13.9-rc1
v9.3.0-rc0
v9.3.0-rc1
v9.4.0
v9.4.0-rc0
v9.4.0-rc1
v9.4.1
v9.4.1-rc1
v9.4.2
v9.4.2-rc1
v9.4.3
v9.4.3-rc1
v9.4.4
v9.5.0
v9.5.0-rc1
v9.5.0-rc2
v9.6.0
v9.6.0-rc1
v9.6.1
v9.6.2
v9.7.0
v9.7.1
v9.7.2
v9.8.0
v9.8.0-rc1
v9.8.1
v9.8.1-rc1
v9.9.0
v9.9.1
v9.9.1-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59535.json"