9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24838

CVE-2026-24838: DotNetNuke.Core Vulnerable to Stored XSS via Module Title

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24838

CVE-2026-24838:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
DotNetNuke.Core	nuget	< 9.13.10	9.13.10
DotNetNuke.Core	nuget	>= 10.0.0, < 10.2.0	10.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the module title, which corresponds to the module's 'Header' and 'Footer' in the codebase. An authenticated user with permissions to edit module settings could inject malicious JavaScript into these fields.

The analysis of the patch commit 4a4bcbcdf3cedbf702816f8168c4d51bf688f7f6 reveals two key areas where the vulnerability existed and was subsequently fixed:

Input Storage: The DotNetNuke.Modules.Admin.Modules.ModuleSettings.OnUpdateClick method in Modulesettings.ascx.cs is responsible for saving the module settings. Prior to the patch, this method directly saved the content of the header and footer text boxes (txtHeader.Text, txtFooter.Text) into the database without sanitization. This is the entry point for the malicious script.
Data Retrieval and Display: The DotNetNuke.Entities.Tabs.TabModulesController.GetTabModules method in TabModulesController.cs retrieves module information to be displayed on a page. Before the patch, this method did not sanitize the header and footer content retrieved from the database. This unsanitized data would then be rendered on the client-side, leading to the execution of the stored script.

The patch addresses the vulnerability by introducing sanitization at both points. It adds server-side validation in OnUpdateClick to check for and reject JavaScript if it's disallowed. It also adds a sanitization step in GetTabModules to clean the data before it's sent to the client for rendering, using the newly added HtmlUtils.SanitizeHtmlIfNeeded function. The frontend code was also updated to use a sanitized HTML rendering component instead of the dangerous dangerouslySetInnerHTML React property, providing defense-in-depth.

Vulnerable functions

DotNetNuke.Modules.Admin.Modules.ModuleSettings.OnUpdateClick

DNN Platform/Website/admin/Modules/Modulesettings.ascx.cs

This function is responsible for updating module settings. Before the patch, it directly assigned the user-provided text from `txtHeader.Text` and `txtFooter.Text` to the module's `Header` and `Footer` properties without any sanitization. This allowed for the storage of malicious scripts (Stored XSS). The patch adds a check using `HtmlUtils.ContainsJavaScript` to prevent saving content with JavaScript if it's not allowed.

DotNetNuke.Entities.Tabs.TabModulesController.GetTabModules

DNN Platform/Library/Entities/Tabs/TabModulesController.cs

This function retrieves all modules for a given tab. Before the patch, it would return the module's `Header` and `Footer` properties as they were stored in the database. If malicious script was stored in these properties, this function would propagate it to be rendered on the page. The patch adds sanitization by calling `HtmlUtils.SanitizeHtmlIfNeeded` on the `Header` and `Footer` properties before returning the module information.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.