CVE-2019-12562

CVE-2019-12562 describes a Stored Cross-Site Scripting (XSS) vulnerability in DotNetNuke (DNN) versions prior to 9.4.0. This flaw allows remote attackers to embed malicious scripts into the admin notification page. Successful exploitation, which occurs when an administrator views the compromised page, could lead to full administrative control, including content manipulation, user management, and backdoor uploads. The vulnerability has a CVSS score of 6.1 (Medium) due to its network-based attack vector and low attack complexity, but requires user interaction. While not listed in CISA's KEV catalog or showing significant community discussion, an exploit is publicly available on ExploitDB.