Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

DotNetNuke uses weak encryption for input data

CVE-2018-15811 · published 7 years ago · actively exploited
Summary

The DotNetNuke (DNN) platform encrypts some input parameters with an algorithm that is not strong enough. This could allow an attacker to decode the protected data and potentially manipulate the system. Update DNN to the latest version or apply the vendor’s patch to use a stronger encryption method.

What to do
  • Update dnn corp dotnetnuke.core to version 9.2.2.
Affected software
Ecosystem VendorProductAffected versions
– dotnetnuke (dnn) dotnetnuke (dnn) All versions
nuget dnn corp dotnetnuke.core >= 9.2.0, < 9.2.2
Fix: upgrade to 9.2.2
– dnnsoftware dotnetnuke >= 9.2, <= 9.2.1
cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*
Original advisory text
DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters.
References
Fix within
Internet-facing 3 days
Internal 14 days
  • Known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
76% chance of attack within 30 days
Type
CWE-326Inadequate Encryption Strength
Timeline
Published3 Jul 2019
Updated20 Oct 2026
First seen6 Mar 2026
Sources
CVE-2018-15811 · CISA KEV
CVE-2018-15811 · NVD
GHSA-h595-8pw6-5q6v · GHSA
CVE-2018-15811 · OSV
Track software like this
Free during beta