5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-52485

CVE-2025-52485: DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

DNN.PLATFORM allows a specially crafted request can inject scripts in the Activity Feed Attachments endpoint which will then render in the feed, resulting in a cross-site scripting attack. This vulnerability is fixed in 10.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-52485

CVE-2025-52485:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
DNN.PLATFORM	nuget	>= 6.0.0, < 10.0.1	10.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the DNN Platform's Activity Feed (also known as the Journal). The root cause is the failure to properly HTML-encode user-supplied data before rendering it on the web page. The investigation of the patch commit 34290ec669355195dbdf972c73b75ddb490d7ade reveals the exact locations of the vulnerability.

The core of the issue lies in the DotNetNuke.Modules.Journal.Components.JournalParser class. Several methods within this class (GetList, GetLikeListHTML, GetCommentRow) were responsible for constructing HTML fragments for the activity feed by concatenating raw user data (like display names, profile URLs, and comments) directly into HTML strings. The patch explicitly adds calls to WebUtility.HtmlEncode in these locations to neutralize any embedded scripts.

A contributing factor was the token replacement system. The change in JournalItemTokenReplace from AddPropertySource to AddRawPropertySource suggests that the previous encoding mechanism was flawed, likely leading to double-encoding issues that complicated and obscured the need for proper, consistent output encoding in the JournalParser. By removing the encoding from the tokenization step and applying it at the final rendering step, the fix ensures that all dynamic data is safely displayed as text rather than being executed as HTML or script by the browser.

An attacker could exploit this by creating a specially crafted profile name, comment, or other input that includes JavaScript. When this malicious content is viewed by other users in the Activity Feed, the script would execute in their browser, potentially leading to session hijacking, data theft, or further attacks. The identified vulnerable functions are the exact points in the code where this malicious input was processed and rendered without sanitization.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.