DNN Platform CVE-2025-64095

The vulnerable component is the default HTML editor provider in DNN installations prior to 10.1.1; the flaw is exploitable where this default provider is in use and its image/file upload handler is reachable. Per the CVSS vector (PR:N/UI:N), exploitation is unauthenticated and requires no user interaction against default configurations. The primary limiting factors are: the target must run DNN before 10.1.1 with the default HTML editor provider, and full XSS impact additionally depends on chaining 'another issue' (unspecified in available data) - overwrite/defacement alone does not require that chain.

Signals are largely aligned toward elevated risk but with one important caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is confirmed for network-based, low-complexity, unauthenticated exploitation with no user interaction, which justifies the 9.8 Critical rating. EPSS reinforces this with an exceptionally high 46.97% probability at the 99th percentile, indicating the model predicts this flaw is far more likely than average to be exploited. However, this is NOT confirmed exploitation: the CVE is not listed in CISA KEV and no public proof-of-concept is referenced, so exploitation status remains 'no public exploit identified at time of analysis' despite the high EPSS. No SSVC decision framework data was provided in the input. There is also a genuine conflict between the CVSS impact metrics and the described behavior: the vector claims C:H/I:H/A:H, but the advisory describes file upload/overwrite enabling defacement and XSS - an integrity/availability problem with only indirect confidentiality impact (via chained XSS), so the C:H rating appears overstated relative to the described mechanism. Net assessment: this is a real priority for DNN operators given unauthenticated network reach, trivial complexity, and very high EPSS, but defenders should note confidentiality impact is weaker than the 9.8 implies and that predicted (EPSS) risk is not the same as observed in-the-wild exploitation.

An attacker on the internet, without any credentials, sends a crafted file upload request to the default HTML editor provider endpoint of a DNN site and overwrites an existing site asset, replacing legitimate content to deface the page. By chaining this with a separate issue, the attacker plants content that injects a stored XSS payload executed in visitors' or administrators' browsers. No public exploit code is referenced, but the attack requires no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N).