CVE-2025-52485: DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

June 20, 2025 (updated September 15, 2025)

DNN.PLATFORM allows a specially crafted request can inject scripts in the Activity Feed Attachments endpoint which will then render in the feed, resulting in a cross-site scripting attack. This vulnerability is fixed in 10.0.1.

References

github.com/advisories/GHSA-wwc9-wmm3-2pmf
github.com/dnnsoftware/Dnn.Platform
github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-wwc9-wmm3-2pmf
nvd.nist.gov/vuln/detail/CVE-2025-52485

Code Behaviors & Features

Detect and mitigate CVE-2025-52485 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →