CVE-2025-59535

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.

• CWE-20
• CWE-200
• CWE-829

• https://github.com/dnnsoftware/Dnn.Platform/blob/develop/DNN%20Platform/Library/UI/Skins/Skin.cs#L305Product
• https://github.com/dnnsoftware/Dnn.Platform/commit/72f30f69fd2214d77f6c2577dfcca495a24caf5cPatch
• https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-wq2j-w9pm-7x2pVendor Advisory

Published

Sep 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59529Avahi is a system which facilitates service discovery on a l…5.5
• CVE-2025-5953The WP Human Resource Management plugin for WordPress is vul…8.8
• CVE-2025-59530quic-go is an implementation of the QUIC protocol in Go. In …7.5
• CVE-2025-59531Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2025-59532Codex CLI is a coding agent from OpenAI that runs locally. I…8.6
• CVE-2025-59534CryptoLib provides a software-only solution using the CCSDS …7.8
• CVE-2025-59536Claude Code is an agentic coding tool. Versions before 1.0.1…8.8
• CVE-2025-59537Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2025-59538Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2025-59539DNN (formerly DotNetNuke) is an open-source web content mana…5.4
• CVE-2025-5954The Service Finder SMS System plugin for WordPress is vulner…9.8
• CVE-2025-59540Chamilo is a learning management system. Prior to version 1.…5.4