CVE-2026-24838

critical · 9.1

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

9.1

CVSS

0.2%

EPSS (exploit prob.)

10th

EPSS percentile

2026-01-28

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
dnnsoftware	dotnetnuke	< 9.13.10
dnnsoftware	dotnetnuke	>= 10.0.0, < 10.2.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-w9pf-h6m6-v89h

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-24838