CVE-2025-32371

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the resulting image and a user that trusts the domain might think that the information is legitimate. This vulnerability is fixed in 9.13.4.

PUBLISHED Reserved 2025-04-06 | Published 2025-04-09 | Updated 2025-04-09 | Assigner GitHub_M

Problem types

CWE-451: User Interface (UI) Misrepresentation of Critical Information

Product status

References

github.com/...atform/security/advisories/GHSA-2rrc-g594-rhqw

github.com/...ommit/5def7cc2e7931bb1041b21540bde99f96874a5a9

cve.org (CVE-2025-32371)

nvd.nist.gov (CVE-2025-32371)

Download JSON