6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-52486

CVE-2025-52486: DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects

DNN.PLATFORM allows specially crafted content in URLs could be used with TokenReplace and not be properly sanitized by some SkinObjects. This vulnerability is fixed in 10.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-52486

CVE-2025-52486:

6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
DNN.PLATFORM	nuget	>= 6.0.0, < 10.0.1	10.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security patch (commit 74f6de68da1572c1d7e9c6e30e9f77f7c5596b1b) reveals two main categories of vulnerabilities related to Cross-Site Scripting (XSS).

First, the core token replacement system in DNN Platform was insecure by design. The various TokenReplace classes did not encode the output of the tokens by default. The patch addresses this by introducing a new method, AddPropertySource, in BaseCustomTokenReplace.cs. This method wraps property sources with encoding handlers (HTML, URL, JavaScript), making HTML encoding the new default. Previously, property sources were added directly to a dictionary, returning raw, unencoded values. This design flaw meant any module or skin using tokens with user-supplied input (e.g., from a URL via RequestPropertyAccess) was likely vulnerable to reflected XSS. The vulnerable functions identified are the constructors of the various TokenReplace classes, as this is where the insecure, non-encoding property sources were configured.

Second, the patch fixed several instances of manual HTML construction without proper output encoding in the JournalParser.cs component. Methods like GetList, GetLikeListHTML, and GetCommentRow were concatenating strings to build HTML, directly embedding data like user names, display names, and URLs without sanitization. The patch rectifies this by consistently applying WebUtility.HtmlEncode to all dynamic data before it is embedded in the HTML output.

The root cause of the vulnerability was a failure to consistently apply output encoding for user-controllable data, both in the centralized token replacement system and in manual HTML string building. An attacker could exploit this by crafting a URL with malicious JavaScript in a parameter that gets processed by a token, or by setting a malicious value (like a display name) that is later rendered unencoded on a page.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.