220 matches found
CVE-2025-65591
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS via the Currencies functionality...
CVE-2025-65590
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS via the Blog posts functionality in the Content Management area...
CVE-2025-65592
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages...
CVE-2025-65593
nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery CSRF via the Schedule Tasks functionality...
CVE-2025-65589
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS via the Attributes functionality...
PT-2025-51770
Name of the Vulnerable Software and Affected Versions nopCommerce version 4.90.0 Description The software is susceptible to Cross Site Scripting XSS through its Currencies functionality. The issue allows for potential malicious code injection via this feature. Recommendations At the moment, there...
PT-2025-51771
Name of the Vulnerable Software and Affected Versions nopCommerce version 4.90.0 Description The software contains a Cross Site Scripting XSS issue within the product management functionality. Malicious payloads entered into the "Product Name" and "Short Description" fields are saved in the backe...
CVE-2025-65589
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS via the Attributes functionality...
CVE-2025-65591
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS via the Currencies functionality...
CVE-2025-65592
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages...
CVE-2025-11699
nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints such as /admin even after the legitimate user has logged out, enabling session hijacking...
EUVD-2025-199992
nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints such as /admin even after the legitimate user has logged out, enabling session hijacking...
CVE-2025-11699
nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints such as /admin even after the legitimate user has logged out, enabling session hijacking...
CVE-2025-11699 CVE-2025-11699
nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints such as /admin even after the legitimate user has logged out, enabling session hijacking...
CVE-2025-11699 CVE-2025-11699
nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints such as /admin even after the legitimate user has logged out, enabling session hijacking...
CVE-2025-11699
The nopCommerce e-commerce platform is vulnerable to session hijacking because it fails to invalidate session cookies upon logout or session termination. This flaw allows an attacker to reuse a valid session cookie to access privileged endpoints , such as /admin , even after the legitimate user h...
CVE-2025-11699 CVE-2025-11699
nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints such as /admin even after the legitimate user has logged out, enabling session hijacking...
nopCommerce 安全漏洞
nopCommerce is a suite of open source, general purpose e-commerce platforms from nopCommerce, Inc. A security vulnerability exists in nopCommerce versions prior to 4.70 and 4.80.3, which stems from a failure to invalidate a session cookie after logout or session termination, which could lead to...
PT-2025-48449
Name of the Vulnerable Software and Affected Versions nopCommerce versions prior to 4.80.3 Description The software does not invalidate session cookies after logout or session termination. This allows an attacker with a valid session cookie to access privileged endpoints, such as '/admin', even...