CVE-2018-18325: DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 73.9% chance of exploitation in the next 30 days.

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

Affected products

• Dnnsoftware DotNetNuke: from 9.2, up to and including 9.2.2

Published 2019-07-03. Last modified 2026-06-17.