Nopcommerce vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Nopcommerce products: 6 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2025-65593 High · 8.8 CWE-352 Dec 16, 2025

Cross-Site Request Forgery (CSRF) in Nopcommerce

nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality.

CVE-2025-65592 Medium · 6.1 CWE-79 Dec 16, 2025

Cross-site Scripting (XSS) in Nopcommerce

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages.

CVE-2025-65591 Medium · 5.4 CWE-79 Dec 16, 2025

Cross-site Scripting (XSS) in Nopcommerce

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.

CVE-2025-65590 Medium · 5.4 CWE-79 Dec 16, 2025

Cross-site Scripting (XSS) in Nopcommerce

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area.

CVE-2025-65589 Medium · 6.1 CWE-79 Dec 16, 2025

Cross-site Scripting (XSS) in Nopcommerce

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality.

CVE-2025-11699 High · 7.1 CWE-613 Dec 1, 2025

nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.