GHSA-w9pf-h6m6-v89h

Source

https://github.com/advisories/GHSA-w9pf-h6m6-v89h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-w9pf-h6m6-v89h/GHSA-w9pf-h6m6-v89h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w9pf-h6m6-v89h

Aliases

CVE-2026-24838

Published

2026-01-28T21:34:02Z

Modified

2026-02-03T03:06:11Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

DotNetNuke.Core Vulnerable to Stored XSS via Module Title

Details

Module title supports richtext which could include scripts that would execute in certain scenarios.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-01-28T21:34:02Z",
    "nvd_published_at":  "2026-01-28T01:16:14Z",
    "severity":  "CRITICAL"
}

References

Affected packages

NuGet / DotNetNuke.Core

Package

Name: DotNetNuke.Core; View open source insights on deps.dev
Purl: pkg:nuget/DotNetNuke.Core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.13.10

Affected versions

6.*

6.0.0

7.*

7.0.0

7.0.6.121

7.1.0

7.1.2

7.2.0.613

7.3.0.499

7.3.1.20

7.4.0.353

7.4.1.280

7.4.2.216

8.*

8.0.0.809

8.0.1.239

8.0.2.4

8.0.3.5

8.0.4.226

9.*

9.0.0.1002

9.0.1.142

9.1.0.367

9.1.1.129

9.2.0.366

9.2.1.533

9.3.0

9.3.1

9.3.2

9.4.0

9.4.1

9.4.2

9.4.3

9.4.4

9.5.0

9.6.1

9.6.2

9.7.0

9.7.1

9.7.2

9.8.0

9.9.0

9.9.1

9.10.0

9.10.1

9.10.2

9.11.0

9.11.1

9.11.2

9.12.0

9.13.0-ci0000

9.13.0

9.13.1

9.13.2

9.13.3

9.13.4

9.13.5-ci0062

9.13.5

9.13.6

9.13.7-ci0064

9.13.7

9.13.8

9.13.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-w9pf-h6m6-v89h/GHSA-w9pf-h6m6-v89h.json"

NuGet / DotNetNuke.Core

Package

Name: DotNetNuke.Core; View open source insights on deps.dev
Purl: pkg:nuget/DotNetNuke.Core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

10.0.0

Fixed

10.2.0

Affected versions

10.*

10.0.0

10.0.1

10.1.0

10.1.1

10.1.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-w9pf-h6m6-v89h/GHSA-w9pf-h6m6-v89h.json"