CVE-2020-11585: Dnnsoftware DotNetNuke

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter.

Affected products

• Dnnsoftware DotNetNuke: version 9.5.0 only

Published 2020-04-06. Last modified 2026-06-17.