CVE-2025-64095 is a critical vulnerability affecting DNN (DotNetNuke) versions prior to 10.1.1, allowing unauthenticated attackers to upload arbitrary files and overwrite existing ones through the default HTML editor. This flaw, rated 9.8 CVSS (CRITICAL), enables website defacement and potential Cross-Site Scripting (XSS) injection due to its network-based attack vector with low complexity and no user interaction required. While not yet in CISA's KEV catalog, exploit intelligence indicates the availability of Nuclei templates for this critical vulnerability, and it has garnered community discussion, urging immediate upgrades to version 10.1.1.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 10.1.1CPE matchmatch criteria | cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.