Loading story…
A critical vulnerability, CVE-2025-64095, has been identified in the DNN Platform, an open-source CMS widely used in the Microsoft ecosystem. The flaw, rated CVSS 10.0, allows unauthenticated attackers to upload files via the default HTML editor provider, enabling them to overwrite existing files on the server. This can result in complete compromise of website confidentiality, integrity, and availability, including defacement and the potential for further attacks such as stored XSS, session hijacking, and credential theft. All versions prior to 10.1.1 are affected, and administrators are strongly urged to update to version 10.1.1 immediately.
The vulnerability is notable for its ease of exploitation, requiring no authentication or privileges. Security advisories recommend that site owners review file logs for unauthorized uploads or modifications if running unpatched versions. The DNN Platform team has released a patch, and immediate action is advised to mitigate the risk of exploitation and potential website compromise.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A ProjectDiscovery Nuclei template pull request was opened to detect CVE-2025-64095 as an unrestricted arbitrary file upload issue in DNN. This added public technical detection content for identifying vulnerable installations.
Public reporting said the issue affects all DNN Platform versions prior to 10.1.1 and can lead to full website compromise, defacement, and stored XSS. Administrators were urged to upgrade immediately to version 10.1.1 and review logs for suspicious uploads or file modifications.
A critical vulnerability, CVE-2025-64095, was disclosed in DNN Platform. The flaw involves insufficient access control in the default HTML editor provider, enabling unauthenticated file upload and overwrite of existing site content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcerunzero.com
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical flaw in the open-source **DotNetNuke** CMS, tracked as **`CVE-2026-40321`**, allows attackers to turn a malicious **SVG** upload into full server compromise by hijacking an administrator’s authenticated browser session. The attack begins when an attacker uploads an SVG file containing JavaScript and persuades a privileged user to open it; the script then runs in that user’s session and abuses trusted access inside the application. Reports say the issue affects a platform used by more than **750,000 websites** and can lead to command execution, malware deployment, data theft, and disruption of security tools on the underlying Windows server. The compromise chain uses DotNetNuke’s authenticated file-write functionality, including the **`/API/personaBar/ConfigConsole/UpdateConfigFile`** endpoint, to write an **ASPX web shell** or other backdoor to disk. Because the technique relies on legitimate SVG files, native browser execution, standard HTTP traffic, and authenticated requests, common controls such as antivirus, firewalls, and malware-removal tools may not reliably detect or block it. An official patch is available, and defenders are being urged to prioritize updates, restrict or disable unnecessary SVG and anonymous uploads, and review user registration settings that could expose the attack path.
Jun 29, 2026
A critical `CVSS 10.0` vulnerability in locally deployed n8n automation instances, tracked as `CVE-2026-21858` and dubbed **Ni8mare**, enables unauthenticated attackers to read arbitrary local files, bypass authentication, and execute commands. The flaw stems from Content-Type confusion in webhook parsing: the Form Webhook node can invoke file handling without requiring `multipart/form-data`, allowing attacker-controlled file paths to be copied into persistent storage. Researchers estimate that roughly 100,000 internet-exposed servers may be affected. Attackers can use the file-read primitive to obtain sensitive files, including `/etc/passwd`, the local SQLite database, and n8n configuration secrets. With database contents and the instance secret, they can forge an `n8n-auth` session cookie, gain administrator access, and create workflows using the **Execute Command** node for remote code execution. Organizations running self-hosted n8n should upgrade to version `1.121.0` or later; no official workaround is available.
Sep 18, 2026
A critical vulnerability in the WordPress plugin **Ninja Forms – File Uploads** has exposed more than **50,000 sites** to unauthenticated arbitrary file upload, with security researchers and CSIRT.SK reporting active exploitation in the wild. Tracked as `CVE-2026-0740`, the flaw affects versions **3.3.26 and earlier** and stems from insufficient validation of uploaded file types, file extensions, and file paths in `NF_FU_AJAX_Controllers_Uploads::handle_upload`, allowing attackers to upload malicious files, including PHP scripts. Successful exploitation can lead to **remote code execution** and full site compromise, giving attackers a path to persistent access and broader server takeover. Defenders are urged to update immediately to **version 3.3.27 or later** and review affected WordPress installations for unauthorized uploads or filesystem changes, as public reporting indicates the vulnerable plugin was deployed on tens of thousands of websites at the time of disclosure.
Jul 24, 2026