According to its self-reported version, the instance of DNN (formerly DotNetNuke) running on the remote web server is prior to 9.13.9. It is, therefore, affected by multiple vulnerabilities:

  - DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft     ecosystem. Prior to version 9.13.9, a malicious SuperUser (Host) could craft a request to use an external     url for a site export to then be imported. Version 9.13.9 fixes the issue. (CVE-2025-48376)

  - DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft     ecosystem. Prior to version 9.13.9, a specially crafted URL may be constructed which can inject an XSS     payload that is triggered by using some module actions. Version 9.13.9 fixes the issue. (CVE-2025-48377)

  - DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft     ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those     scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue. (CVE-2025-48378)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

DNN < 9.13.9 DotNetNuke.Core Multiple Vulnerabilities

medium Nessus Plugin ID 237464

Version 1.2

Version 1.1

Version 1.2 Jan 21, 2026, 5:00 PM IAVM reference Plugin Feed: 202601211700
Version 1.1 May 29, 2025, 11:36 PM New Plugin Feed: 202505292336