CVE-2025-32371 affects DNN (formerly DotNetNuke), an open-source web content management platform. This vulnerability allows an attacker to craft a URL that manipulates the DNN ImageHandler to display arbitrary text within an image, potentially tricking users into believing the information is legitimate due to domain trust. The severity is rated as Medium (CVSS 4.3), indicating a low complexity attack that requires user interaction (UI:R) but has a limited impact on integrity (I:L) and no impact on confidentiality or availability. The attack vector is network-based (AV:N). Currently, there is no evidence of active exploitation, nor is there any publicly available exploit code in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting low awareness and attention to this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 9.13.4CPE matchmatch criteria | cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.