Actively exploited in the wild
DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DotNetNuke (DNN) - DotNetNuke (DNN) · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2018-18325
HighCVSS 7.5KEVSummary
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
Risk Assessment
Weak encryption of parameters could allow an attacker to decrypt or manipulate data, potentially leading to unauthorized access or attacks.
Recommendation
Update DNN to a version that includes the complete fix for CVE-2018-15811.
Other vulnerabilities in DNN (DotNetNuke)
See all- CVE-2025-59545Critical
The Prompt module in DNN (DotNetNuke) before version 10.1.0 allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display, can be executed when processed through certain commands, leading to potential script execution (XSS). Patched in version 10.1.0.
- CVE-2018-15811HighActively exploited
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
Original NVD description (English source)
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS