CVE-2025-64095: Critical CVSS 10.0 Flaw in DNN Platform Allows Unauthenticated Website Overwrite

CVE-2025-64095 is described as a critical CVSS 10.0 flaw in the DNN Platform that allows an unauthenticated user to overwrite files on the server, potentially leading to full site compromise. According to the report, the vulnerability resides in the default HTML editor provider included with the DNN Platform and requires no authentication to exploit.

It states that an attacker can upload a file and use it to overwrite existing files, with the most direct consequence being website defacement and the potential to inject XSS payloads when combined with other vulnerabilities. The article notes that the DNN Platform has more than 750,000 websites affected and that all versions prior to 10.1.1 are vulnerable, with a fix available by updating to version 10.1.1.

It also advises site owners to check file logs for unauthorized uploads or modifications if they are running an unpatched version. According to the piece, administrators must treat this advisory with the highest urgency.