Hi there
I think we can assist you best if you log your issue on https://github.com/dnnsof...urity/advisories/new

To add to Tycho reply, that url is THE place to report/discuss any potential security issue as it allows having a more detailed private discussion and get help from a team that knows a lot for DNN security. It is important though before getting into that:
1. Update to the latest DNN version
2. Remove Telerik
3. Make sure everything is green in the Security Analyzer

We care a lot about security and using that link is the first step and then we can exchange the whole story and logs and what not in a private setting.

Thanks for the reply, guys.

Sorry, I don't want to alarm anybody about any new vulnerabilities or anything, as I don't believe it's anything of that nature.

I've been in contact with the OG Mitchel Sellers, and he's been assisting.

I'll go ahead and log the issue on github, though I'm not able to confirm everything as green on security analyzer as our site is currently offline.  I can tell you we're on 9.11.2 and we still needed Telerik for some things, so it was patched with a newer dll provided for free by Telerik.

After looking at the vulnerability report page on github, that doesn't look like something necessary for this.

I'll share this: we noticed files added to our root directory that weren't done by us.  Also noticed AdSense ads being servered that weren't ours.

After some digging and help from Mitchel, all signs point to an outdated (and unused) module.  Unforunately we missed it during the last upgrade as it isn't used.  I don't want to slander the module providers name, as this is more of an oversite on our part, but you can read more about it here if you want to see the fussing and fighting - Will will likely remember this post, haha.

Thanks

As people will follow the link, the vendor is still exposed. And the issue was broadcasted b yDNN Corp as quite serious. To put it in perspective:

• It is an issue dating from 7 years ago
• It was the only issue (AFAIK) of this vendor in 15 years
• The issue was solved and the modules are still maintained and features added 

Posted By Tycho de Waard (SU) on 3/27/2025 2:57 AM

As people will follow the link, the vendor is still exposed. And the issue was broadcasted b yDNN Corp as quite serious. To put it in perspective:

• It is an issue dating from 7 years ago
• It was the only issue (AFAIK) of this vendor in 15 years
• The issue was solved and the modules are still maintained and features added 

Thank you for documenting this again for the community and ecosystem, Tycho!  💪🏽