CVE-2013-4649: Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remot...

Security readout for executives and security teams

This is a cross-site scripting issue in older DotNetNuke installations. A remote attacker could inject script or HTML through a DNN parameter on the default URI. For executives, the concern is exposed legacy DNN sites where user sessions, trust, or site content could be abused. Exposure is most likely on internet-facing DotNetNuke sites running versions earlier than 6.2.9 or 7.1.1. The CVE metadata does not provide CPEs, so teams should confirm DNN presence and exact version from application inventory or administration records. Treat this as a legacy web application exposure item. It is not KEV-listed in the bundle, but public-facing vulnerable DNN sites should be remediated because XSS can affect users, sessions, and brand trust. Mitigation focus: Identify any DotNetNuke or DNN deployments and their exact versions.; Upgrade versions before 6.2.9 or 7.1.1 according to vendor guidance.; Review the DNN security center for any superseding advisories..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.