Actively exploited in the wild
DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DotNetNuke (DNN) - DotNetNuke (DNN) · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2018-15811
HighCVSS 7.5KEVSummary
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
Risk Assessment
Weak encryption of parameters could allow an attacker to decrypt or manipulate data, potentially leading to unauthorized access or attacks.
Recommendation
Update DNN to a patched version.
Other vulnerabilities in DNN (DotNetNuke)
See all- CVE-2025-59545Critical
The Prompt module in DNN (DotNetNuke) before version 10.1.0 allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display, can be executed when processed through certain commands, leading to potential script execution (XSS). Patched in version 10.1.0.
- CVE-2018-18325HighActively exploited
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
Original NVD description (English source)
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS