CVE-2026-117605

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

CVE-2026-117605 nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

EUVD-2026-111571

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

CVE-2026-117605

The nopCommerce e-commerce platform, specifically versions before 5.00.0 , is vulnerable to a missing authorization flaw in the ProductController. The RelatedProductAddPopup, CrossSellProductAddPopup, and AssociatedProductAddPopup handlers fail to verify the ownership of the parent product. This ...

CVE-2026-117605

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

CVE-2026-117605 nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

CVE-2026-117605 nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

PT-2026-127729

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

PT-2026-89416

Got another CVE CVE-2026-50808 with my co-worker! This time in @nopCommerce ! There is no released version with a fix, so please make sure you mitigate it until a fix is released! Read more here: https://t.co/FUtEAROFEE...

nopCommerce Installer - Detect

nopCommerce installer panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """nopCommerce installer panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'nopCommerce Installer - Detect',...

CVE-2022-33077

An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint...

CVE-2019-11519

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

CVE-2022-27461

In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link...

CVE-2025-65591

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS via the Currencies functionality...

CVE-2025-65589

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS via the Attributes functionality...

CVE-2025-65593

nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery CSRF via the Schedule Tasks functionality...

CVE-2025-65590

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS via the Blog posts functionality in the Content Management area...

CVE-2025-65592

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages...

EUVD-2025-203832

nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery CSRF via the Schedule Tasks functionality...

EUVD-2025-203833

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages...