Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-17y1-2fdf-57b1
Vulnerability ID VCID-17y1-2fdf-57b1
Aliases CVE-2015-2794
GHSA-x8f7-h444-97w4
Summary Insecure Default Initialization of Resource The installation wizard in DotNetNuke (DNN) allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
Status Published
Exploitability 2.0
Weighted Severity 9.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.927 https://api.first.org/data/v1/epss?cve=CVE-2015-2794
cvssv3.1 9.8 https://dotnetnuke.codeplex.com/releases/view/615317
generic_textual CRITICAL https://dotnetnuke.codeplex.com/releases/view/615317
cvssv3.1 9.8 https://github.com/advisories/GHSA-x8f7-h444-97w4
generic_textual CRITICAL https://github.com/advisories/GHSA-x8f7-h444-97w4
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2015-2794
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2015-2794
cvssv3.1 9.8 https://www.exploit-db.com/exploits/39777
generic_textual CRITICAL https://www.exploit-db.com/exploits/39777
cvssv3.1 9.8 http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue
generic_textual CRITICAL http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue
cvssv3.1 9.8 http://www.dnnsoftware.com/community/security/security-center
generic_textual CRITICAL http://www.dnnsoftware.com/community/security/security-center
cvssv3.1 9.8 http://www.securityfocus.com/bid/96373
generic_textual CRITICAL http://www.securityfocus.com/bid/96373
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2015-2794
https://dotnetnuke.codeplex.com/releases/view/615317
https://github.com/advisories/GHSA-x8f7-h444-97w4
https://www.exploit-db.com/exploits/39777
https://www.exploit-db.com/exploits/39777/
http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue
http://www.dnnsoftware.com/community/security/security-center
http://www.securityfocus.com/bid/96373
CVE-2015-2794 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/asp/webapps/39777.txt
CVE-2015-2794 https://nvd.nist.gov/vuln/detail/CVE-2015-2794
Data source Exploit-DB
Date added May 6, 2016
Description DotNetNuke 07.04.00 - Administration Authentication Bypass
Ransomware campaign use Known
Source publication date May 6, 2016
Exploit type webapps
Platform asp
Source update date May 6, 2016
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://dotnetnuke.codeplex.com/releases/view/615317
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/advisories/GHSA-x8f7-h444-97w4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2015-2794
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.exploit-db.com/exploits/39777
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.dnnsoftware.com/community/security/security-center
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.securityfocus.com/bid/96373
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.99762
EPSS Score 0.927
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:36:47.332307+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/nuget/DotNetNuke.Core/CVE-2015-2794.yml 38.6.0