CVE-2025-59539 Overview
DNN Platform (formerly DotNetNuke) contains a stored cross-site scripting (XSS) vulnerability in the user profile Biography field. Prior to version 10.1.0, authenticated users could inject JavaScript into the Biography field even when rich-text formatting was disabled. The injected script executes in the browser context of any user who views the profile, including administrators and superusers. DNN is an open-source content management system (CMS) built on the Microsoft .NET stack and widely deployed across enterprise web properties. The issue is tracked under [CWE-79] and was patched in DNN 10.1.0.
Critical Impact
A low-privileged authenticated user can execute arbitrary JavaScript in an administrator's browser session, enabling account takeover of superuser accounts and full CMS compromise.
Affected Products
- DNN Platform (DotNetNuke) versions prior to 10.1.0
- DNN Platform 10.1.0 release candidate 1 (10.1.0:rc1)
- Deployments exposing user profile pages to authenticated or anonymous visitors
Discovery Timeline
- 2025-09-23 - CVE-2025-59539 published to the National Vulnerability Database
- 2025-09-23 - GitHub Security Advisory GHSA-7rcc-q6rq-jpcm published by the DNN Platform maintainers
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-59539
Vulnerability Analysis
The flaw is a stored cross-site scripting vulnerability in the DNN user profile subsystem. The Biography property accepts and persists user-supplied content that is later rendered on profile pages consumed by other authenticated users. When the field is configured as a plain-text property rather than rich-text, the application still fails to encode HTML and script content on output. As a result, <script> tags and event-handler attributes stored in the Biography field execute in the viewing user's session context.
Exploitation requires only a valid low-privilege account and user interaction to view the malicious profile. Because DNN administrators and superusers routinely review member profiles for moderation, the payload can reach highly privileged sessions. Successful execution allows session token theft, forced administrative actions through the DNN management interface, and pivoting to full site compromise.
Root Cause
The underlying defect is missing output encoding of a profile property that was not classified as rich-text. The application appears to trust that non-rich-text fields do not require HTML sanitization, so stored input flows unchanged into the rendered profile markup. This is a classic neutralization failure aligned with [CWE-79].
Attack Vector
An attacker registers or authenticates as a standard portal user, then edits their profile and stores a JavaScript payload in the Biography field. When any other user, including an administrator, opens the attacker's profile page, the browser parses and executes the payload under the site's origin. From that context the payload can call DNN administrative endpoints, exfiltrate authentication cookies not protected by HttpOnly, or modify site content and user accounts.
See the DNN Platform Security Advisory GHSA-7rcc-q6rq-jpcm for vendor-supplied technical details.
Detection Methods for CVE-2025-59539
Indicators of Compromise
- Profile records containing <script>, onerror=, onload=, or javascript: substrings in the Biography property
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing user profiles
- New superuser accounts, role assignments, or module installations created during administrator sessions
Detection Strategies
- Query the DNN UserProfile and ProfilePropertyDefinition tables for Biography values containing HTML or script markup
- Review web server access logs for POST requests to profile update endpoints followed by GET requests from privileged accounts to the same profile
- Inspect browser Content Security Policy (CSP) violation reports for inline script blocks originating on profile view pages
Monitoring Recommendations
- Alert on administrative actions (user creation, role change, file upload) that occur within seconds of loading a member profile page
- Enable and centrally collect DNN event logs, particularly USER_UPDATED and PROFILE_UPDATED events
- Monitor for anomalous session activity from administrator accounts, including requests originating from unusual user agents or IP addresses
How to Mitigate CVE-2025-59539
Immediate Actions Required
- Upgrade DNN Platform to version 10.1.0 or later on all production and staging portals
- Audit existing user profiles for stored HTML or JavaScript in the Biography field and sanitize or clear affected records
- Rotate credentials and session tokens for any administrator or superuser accounts that may have viewed untrusted profiles
Patch Information
The vulnerability is fixed in DNN Platform 10.1.0. Apply the update per the vendor advisory at GitHub Security Advisory GHSA-7rcc-q6rq-jpcm. No official workaround eliminates the risk without upgrading.
Workarounds
- Restrict profile visibility to authenticated administrators only until the patch is deployed
- Disable new user self-registration to reduce the attack surface from anonymous account creation
- Deploy a strict Content Security Policy that blocks inline scripts on profile rendering pages
- Configure session cookies with HttpOnly and Secure flags to limit token theft via injected scripts
# Example web.config hardening for DNN session cookies
<system.web>
<httpCookies httpOnlyCookies="true" requireSSL="true" />
<sessionState cookieless="UseCookies" />
</system.web>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
