What is the CVSS score of CVE-2025-52486?

CVE-2025-52486 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Dotnetnuke are affected by CVE-2025-52486?

Organizations using the Microsoft ecosystem. In should be aware of moderate risk from CVE-2025-52486, a cross-site scripting vulnerability rated CVSS 6.1.. A patch is available.

How to fix or mitigate CVE-2025-52486?

Within 30 days: Identify affected systems running the Microsoft ecosystem. In and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Dotnetnuke CVE-2025-52486

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-21 security-advisories@github.com

GHSA-pf4h-vrv6-cmvr

Microsoft XSS Dotnetnuke

6.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 15, 2026 - 21:35 vuln.today

Patch released

Mar 15, 2026 - 21:35 nvd

Patch available

CVE Published

Jun 21, 2025 - 03:15 nvd

MEDIUM 6.1

DescriptionGitHub Advisory

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows specially crafted content in URLs to be used with TokenReplace and not be properly sanitized by some SkinObjects. This issue has been patched in version 10.0.1.

Analysis

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

A vendor patch is available — apply it immediately. Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.