CVE-2026-117605

The nopCommerce e-commerce platform, specifically versions before 5.00.0 , is vulnerable to a missing authorization flaw in the ProductController. The RelatedProductAddPopup, CrossSellProductAddPopup, and AssociatedProductAddPopup handlers fail to verify the ownership of the parent product. This ...

EUVD-2026-111571

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...