CVE-2026-24838Disclosure(dnnsoftware / dotnetnuke)

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch dnnsoftware dotnetnuke systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

dnnsoftware CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-w9pf-h6m6-v89h

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

dotnetnuke

Threat summary

Patch or workaround signal is available
6 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 5 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 2d ago at 3 mentions (2026-01-28); latest day: 1
6 total mentions across 3 days

Affected systems

Vendors

dnnsoftware

Products

dotnetnuke

Deep dive

Activity timeline6 mentions / 3d

Signal classification3 categories

Disclosure

466.7%

General

116.7%

Patch

116.7%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-01-28	3	Disclosure2General1
2026-01-29	2	Disclosure1Patch1
2026-02-02	1	Disclosure1

Full discourse6 posts

CRAC Learning - Tech@cracbot248d
Disclosure
CVE-2026-24838 (CVSS:9.1, CRITICAL) is Undergoing Analysis. DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v..https://nvd.nist.gov/vuln/detail/CVE-2026-24838 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2026-24838, noting its critical CVSS score and that it is under analysis, but it does not provide any PoC, exploit code, or patch information.
0101149
171 followersView on X
PulsePatch.io@pulsepatchio252d
Patch
DotNetNuke Core is affected by a stored XSS vulnerability (CVE-2026-24838) via module titles. This allows authenticated attackers to inject malicious scripts. Review permissions and patch to 9.13.10. #DotNetNuke #XSS #infosec https://www.pulsepatch.io/posts/cve-2026-24838-dotnetnuke-core-stored-xss
Post summary
The post announces a stored XSS flaw (CVE-2026-24838) in DotNetNuke Core and recommends updating to version 9.13.10 to remediate the issue.
0000067
1 followersView on X
cvereports@_cvereports253d
Disclosure
CVE-2026-24838: The Title That Stole Your Session: Deep Dive into CVE-2026-24838 A critical Stored Cross-Site Scripting (XSS) vulnerability exists in the DNN (DotNetNuke) Platform's module title rendering logic. By injecting malicious scripts into the... https://cvereports.com/reports/CVE-2026-24838
Post summary
The post describes a critical stored XSS flaw in DNN’s title rendering but offers no PoC, exploit code, evidence of active use, or mitigation guidance.
0000061
29 followersView on X
PulsePatch.io@pulsepatchio253d
Disclosure
A stored XSS vulnerability (CVE-2026-24838) impacts DotNetNuke. Malicious scripts can be embedded in module titles, affecting users. Update advised. #DotNetNuke #XSS #infosec https://www.pulsepatch.io/posts/cve-2026-24838-dotnetnuke-stored-xss
Post summary
The post announces a stored XSS flaw (CVE‑2026‑24838) in DotNetNuke that allows malicious scripts in module titles and advises users to apply an update.
0000050
1 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds253d
Disclosure
CVE-2026-24838 Cross-Site Scripting in DNN CMS Module Titles Before 9.13.10 and 10.2.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24838
Post summary
The text announces CVE‑2026‑24838, a Cross‑Site Scripting vulnerability in DNN CMS module titles affecting versions prior to 9.13.10 and 10.2.0. No Proof of Concept, exploit code, active exploitation claim, or patch information is provided.
0000058
4.0K followersView on X
CVE@CVEnew254d
General
CVE-2026-24838 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supp… https://www.cve.org/CVERecord?id=CVE-2026-24838
Post summary
The text references CVE‑2026‑24838 affecting DNN/CMS, indicating vulnerability in versions prior to 9.13.10 and 10.2.0, but offers no exploit details, patch information, or technical specifics.
00000334
56.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	dnnsoftware	dotnetnuke	-	-	-

Explore more

Back to dashboard dnnsoftware CVEs dotnetnuke vulnerabilities

What researchers are saying

CVE-2026-24838

CRAC Learning - Tech@cracbotDisclosure

The post announces CVE-2026-24838, noting its critical CVSS score and that it is under analysis, but it does not provide any PoC, exploit code, or patch information.

PulsePatch.io@pulsepatchioPatch

The post announces a stored XSS flaw (CVE-2026-24838) in DotNetNuke Core and recommends updating to version 9.13.10 to remediate the issue.

cvereports@_cvereportsDisclosure

The post describes a critical stored XSS flaw in DNN’s title rendering but offers no PoC, exploit code, evidence of active use, or mitigation guidance.

PulsePatch.io@pulsepatchioDisclosure

The post announces a stored XSS flaw (CVE‑2026‑24838) in DotNetNuke that allows malicious scripts in module titles and advises users to apply an update.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces CVE‑2026‑24838, a Cross‑Site Scripting vulnerability in DNN CMS module titles affecting versions prior to 9.13.10 and 10.2.0. No Proof of Concept, exploit code, active exploitation claim, or patch information is provided.

CVE@CVEnewGeneral

The text references CVE‑2026‑24838 affecting DNN/CMS, indicating vulnerability in versions prior to 9.13.10 and 10.2.0, but offers no exploit details, patch information, or technical specifics.