The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
SummaryAI-written · claude-haiku-5-5AI-written · claude-haiku-5-5Written by a language model from the source data on this page. Not reviewed by a person. Generated 29 Oct 2026.
The installation wizard in DotNetNuke (DNN) before 7.4.1 contains a flaw that lets the application be reinstalled and grants SuperUser access.
Heading is the official description · CVE.orgSource dataSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. Copied from CVE.org.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown.Breakdown
24.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (Exploit-DB) was available 9 months before disclosure.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
7 fixes in DotNetNuke.Core over 4 years. The latest fix listed for DotNetNuke.Core is 9.2.0.
Fixes in DotNetNuke.CoreNuGet package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linked
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSVSourceSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. GitHub Security Advisories and OSV.
1 package in 1 ecosystem. Main package: DotNetNuke.Core.
Still affected on this line by CVE-2017-0929 (fixed in 9.2.0, a newer line); CVE-2017-9822 (fixed in 9.1.1, a newer line); CVE-2018-18325 (fixed in 9.3.0, a newer line); CVE-2018-18326 (fixed in 9.3.0, a newer line).
Set the version to 7.4.1 or later in your .csproj.
The first fix for CVE-2015-2794.
Affected versions
If you run
Upgrade to
All versions before 7.4.1
7.4.1
“Up to” means the second version is the fix and is not affected.