CVE-2025-48377: Reflected Cross-Site Scripting (XSS) in module actions in edit mode

May 23, 2025 (updated October 31, 2025)

A specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions.

References

github.com/advisories/GHSA-79m3-rvx2-3qq9
github.com/dnnsoftware/Dnn.Platform
github.com/dnnsoftware/Dnn.Platform/commit/351b166492ad4b6509c273dc83211d52238e31a7
github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-79m3-rvx2-3qq9
nvd.nist.gov/vuln/detail/CVE-2025-48377

Code Behaviors & Features

Detect and mitigate CVE-2025-48377 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →