CVE-2025-52485: DNN Platform XSS Vulnerability

CVE-2025-52485 Overview

CVE-2025-52485 is a stored Cross-Site Scripting (XSS) vulnerability in DNN Platform, formerly known as DotNetNuke, an open-source content management system (CMS) built on Microsoft technologies. The flaw affects DNN.PLATFORM versions 6.0.0 through 10.0.0. An authenticated attacker can send a specially crafted request to the Activity Feed Attachments endpoint, injecting script content that renders when other users view the activity feed. The issue is tracked as [CWE-79] and was fixed in version 10.0.1.

Critical Impact
Authenticated attackers can inject persistent JavaScript into the Activity Feed, enabling session theft, credential harvesting, and account takeover against any user viewing the feed.

Affected Products

DNN Platform (DotNetNuke) versions 6.0.0 through 10.0.0
dnnsoftware/Dnn.Platform repository builds prior to 10.0.1
Sites exposing the Activity Feed Attachments endpoint to authenticated users

Discovery Timeline

2025-06-21 - CVE-2025-52485 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52485

Vulnerability Analysis

The vulnerability resides in the Activity Feed Attachments endpoint of DNN.PLATFORM. The endpoint accepts attachment metadata from authenticated users without sufficient output encoding. Attacker-supplied script content is stored server-side and later rendered inline when the activity feed loads for other users. This makes the flaw a stored XSS, categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Stored XSS in a CMS activity feed reaches every user who visits an affected page. Successful exploitation lets attackers execute JavaScript in the victim's browser session, steal authentication cookies, perform actions on behalf of privileged users, and pivot toward administrative account compromise.

Root Cause

The root cause is missing or inadequate HTML encoding of user-controlled attachment fields before they are written into the DOM of the Activity Feed view. The endpoint trusts input from any authenticated caller and stores raw content that is later rendered as markup rather than as inert text.

Attack Vector

Exploitation requires network access to the DNN site and a low-privilege authenticated account. The attacker submits a crafted request to the Activity Feed Attachments endpoint containing script payloads in attachment fields. When another user, including administrators, loads the feed, the browser parses and executes the injected script. User interaction is required to trigger rendering of the malicious content.

No verified public exploit code has been released. See the GitHub Security Advisory GHSA-wwc9-wmm3-2pmf for vendor technical details.

Detection Methods for CVE-2025-52485

Indicators of Compromise

Activity Feed attachment records containing <script>, javascript:, or event-handler attributes such as onerror= and onload=
HTTP POST requests to Activity Feed Attachments endpoints with payload bodies containing HTML tags or encoded script fragments
Unexpected outbound requests from user browsers to attacker-controlled domains after loading DNN activity feed pages

Detection Strategies

Query the DNN database for stored attachment fields matching XSS signatures such as <, >, script, or on\w+=
Inspect web server access logs for POST requests to activity feed endpoints originating from low-privilege accounts with unusually large or HTML-bearing payloads
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts on authenticated CMS pages

Monitoring Recommendations

Alert on new or modified activity feed records containing HTML markup or script keywords
Monitor administrator sessions for anomalous actions immediately following an activity feed page load
Track authentication cookie usage across geographies and devices to identify session theft consistent with XSS-driven account takeover

How to Mitigate CVE-2025-52485

Immediate Actions Required

Upgrade DNN.PLATFORM to version 10.0.1 or later, which contains the vendor fix
Audit existing activity feed and attachment records for previously injected script content and purge malicious entries
Rotate credentials and invalidate active sessions for administrative accounts that may have viewed the feed during the exposure window

Patch Information

The vendor released a fix in DNN.PLATFORM 10.0.1. Details are documented in the GitHub Security Advisory GHSA-wwc9-wmm3-2pmf. Administrators should apply the update through the standard DNN upgrade process and verify the installed version after deployment.

Workarounds

Restrict access to the Activity Feed Attachments endpoint at the reverse proxy or web application firewall (WAF) layer until patching is complete
Enforce a strict Content Security Policy that disallows inline scripts on authenticated CMS pages to reduce impact of stored XSS
Limit activity feed posting permissions to trusted roles and disable attachment uploads for untrusted user groups

bash

# Example WAF rule concept: block HTML/script markup in Activity Feed Attachments POST bodies
# Adapt to your WAF syntax (ModSecurity example)
SecRule REQUEST_URI "@contains /ActivityFeed/Attachments" \
  "chain,phase:2,deny,status:403,id:1005248501,msg:'DNN CVE-2025-52485 XSS attempt'"
  SecRule REQUEST_BODY "@rx (?i)(<script|javascript:|on\w+\s*=)" "t:none"