Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2025-64095

CriticalPublished

DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

Published: Oct 28, 2025
Updated: Oct 29, 2025
Assigning CNA: GitHub_M
Evidence observed: Aug 8, 2026

Primary CVSS

10.0/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS probability estimate

44.7%

Moderate · next 30 days

Percentile: 98.8%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1.

Sources

CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-uploadPoC
POC of DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
CVE-2025-64095PoC
Proof-of-concept exploit for CVE-2025-64095 targeting DNN CMS, enabling unauthenticated file upload and overwrite to deface sites or inject XSS payloads.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.