Vulnerabilities > Dotnetnuke

DATE CVE VULNERABILITY TITLE RISK
2017-02-06 CVE-2015-2794 Permissions, Privileges, and Access Controls vulnerability in Dotnetnuke
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
network
low complexity
dotnetnuke CWE-264
7.5
2016-08-31 CVE-2016-7119 Cross-site Scripting vulnerability in Dotnetnuke
Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element.
network
dotnetnuke CWE-79
3.5
2015-02-09 CVE-2015-1566 Cross-site Scripting vulnerability in Dotnetnuke
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
network
dotnetnuke CWE-79
4.3
2014-03-12 CVE-2013-7335 Improper Input Validation vulnerability in Dotnetnuke
Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
network
dotnetnuke CWE-20
4.3
2014-03-12 CVE-2013-4649 Cross-Site Scripting vulnerability in Dotnetnuke
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.
network
dotnetnuke CWE-79
4.3
2014-03-12 CVE-2013-3943 Cross-Site Scripting vulnerability in Dotnetnuke
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile.
network
dotnetnuke CWE-79
3.5
2012-04-11 CVE-2012-1036 Cross-Site Scripting vulnerability in Dotnetnuke
Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.
network
dotnetnuke CWE-79
4.3
2012-04-11 CVE-2012-1030 Cross-Site Scripting vulnerability in Dotnetnuke 6.0.0/6.0.1/6.0.2
Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup.
network
dotnetnuke CWE-79
4.3
2010-12-09 CVE-2010-4514 Cross-Site Scripting vulnerability in Dotnetnuke 5.05.01/5.06.00
Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter.
network
dotnetnuke CWE-79
4.3
2009-11-29 CVE-2009-4110 Cross-Site Scripting vulnerability in Dotnetnuke
Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page.
network
dotnetnuke CWE-79
4.3