CVE-2025-59535

MediumCVSS 6.5/10Last modified Oct 11, 2026

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-20CWE-200CWE-829

Affected software

No affected versions have been published.

Timeline

Published
Sep 22, 2025
Last modified
Oct 11, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-595368.8Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog imCVE-2025-595377.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1CVE-2025-595387.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rcCVE-2025-595395.4DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when CVE-2025-59549.8The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and incCVE-2025-595405.4Chamilo is a learning management system. Prior to version 1.11.34, a stored XSS vulnerability exists in Chamilo LMS that allows a staff accoCVE-2025-595418.1Chamilo is a learning management system. Prior to version 1.11.34, a Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to dCVE-2025-595429.0Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting CVE-2025-595439.0Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting CVE-2025-595444.3Chamilo is a learning management system. Prior to version 1.11.34, the functionality for the user to update the category does not implement CVE-2025-595459.0DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the PCVE-2025-595464.8DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, admin
CVE-2025-59535: Medium severity, CVSS 6.5 | Vulnix