CVE-2020-11585

PoC —

CVSS 3.1

4.3 medium

EPSS

<1%p51

Published

Apr 6, 2020 (Apr 6, 2020)

Modified

Jun 17, 2026

Description

There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter.

Vendors: dnnsoftware
Products: dotnetnuke
Weakness: CWE-330, CWE-639
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.