6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59539

CVE-2025-59539: DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

Summary

Users can use special syntax to inject javascript code in their profile biography field. Although there was sanitization in place, it did not cover all possible scenarios

Description

When embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59539

CVE-2025-59539:

6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
DotNetNuke.Core	nuget	< 10.1.0	10.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the profile biography field of the DNN platform. The analysis of the commits between the vulnerable version and the patched version revealed a key commit that directly addresses this issue. The commit with the message 'Use text binding to display biography in template' contains the fix.

The patch modifies two template files: Blank Website.template and Default Website.template. In both files, the Knockout.js data-binding for the biography field was changed from data-bind="html: Biography" to data-bind="text: Biography". The html binding allows rendering of raw HTML content, which is the root cause of the XSS vulnerability. By changing it to text, the content of the biography is treated as plain text, and any embedded HTML or script tags are properly escaped, thus mitigating the vulnerability.

The vulnerable 'function' is not a traditional server-side function but rather the client-side rendering logic within the user profile template. The provided function name ProfileBiography.render is a descriptive name representing the vulnerable operation of rendering the biography, as this is what a developer would look for when trying to understand the runtime behavior of the exploit.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.