CVE-2025-64095: Ransomware-Style Defacement Attacks Likely as DNN Flaw is Probed
The CrowdSec Network has detected a wave of exploitation attempts targeting CVE-2025-64095, a cross-site scripting vulnerability in the DNN Platform (formerly DotNetNuke). CVE-2025-64095 allows attackers to upload arbitrary files to DNN without requiring any authentication checks. It also allows attackers to overwrite existing files in the filesystem. As DNN is often used as a public-facing CMS, this vulnerability could lead to website defacing, a tactic often used by ransomware groups. Attackers could also execute cross-site scripting attacks by uploading arbitrary scripts that might be executed in the browsers of users. CrowdSec intelligence has identified approximately 30 distinct IP addresses probing for this vulnerability. The vulnerability affects all versions of DNN 10.1.1.
CrowdSec’s key findings on CVE-2025-64095
The vulnerability was published to NVD on October 28, 2025. CrowdSec started tracking active exploitation on November 27, 2025, with the first attacks detected almost immediately after.
Exploitation attempts were discovered almost immediately after the release of the detection rule, suggesting ongoing exploitation campaigns.
While detailed write-ups of the vulnerability don’t exist yet, proof-of-concept code has been shared publicly. Combined with the information about attacks detected by CrowdSec, we conclude that exploitation is very likely.
...
