Vulnerabilidades de Nopcommerce
CVEs publicadas que afetam produtos de Nopcommerce: 6 registro(s), com severidade, exploração e correções.
CVE-2025-65593
Alta · 8.8
CWE-352 16/12/2025
Cross-Site Request Forgery (CSRF) em Nopcommerce
nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality.
CVE-2025-65592
Média · 6.1
CWE-79 16/12/2025
Cross-site Scripting (XSS) em Nopcommerce
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages.
CVE-2025-65591
Média · 5.4
CWE-79 16/12/2025
Cross-site Scripting (XSS) em Nopcommerce
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.
CVE-2025-65590
Média · 5.4
CWE-79 16/12/2025
Cross-site Scripting (XSS) em Nopcommerce
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area.
CVE-2025-65589
Média · 6.1
CWE-79 16/12/2025
Cross-site Scripting (XSS) em Nopcommerce
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality.
CVE-2025-11699
Alta · 7.1
CWE-613 01/12/2025
CVE-2025-11699
nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a
a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.