Browse CVEs

HIGH 8.8 CVE-2025-65593 nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality. Nopcommerce Mitigation only Fix from $1,9502025-12-16 MEDIUM 6.1 CVE-2025-65592 nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product… Nopcommerce Mitigation only Fix from $1,6002025-12-16 MEDIUM 5.4 CVE-2025-65590 nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area. Nopcommerce Mitigation only Fix from $1,6002025-12-16 MEDIUM 5.4 CVE-2025-65591 nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality. Nopcommerce Mitigation only Fix from $1,6002025-12-16 MEDIUM 6.1 CVE-2025-65589 nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality. Nopcommerce No fix yet Fix from $1,6002025-12-16 HIGH 7.1 CVE-2025-11699 nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who ha… Nopcommerce 4.70.0+ Fix from $1,9502025-12-01 MEDIUM 6.1 CVE-2021-42193 nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]. Each time a user views the product in the shop, the XSS payl… Nopcommerce No fix yet Fix from $1,6002025-10-03 MEDIUM 6.1 CVE-2024-38963 Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined "AddProductReview.Title" and "AddProductReview.ReviewText" parameter(… Nopcommerce No fix yet Fix from $1,6002024-07-09 MEDIUM 6.1 CVE-2022-26954 Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to … Nopcommerce 4.50.2+ Fix from $1,6002022-10-20 HIGH 7.5 CVE-2022-33077 An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint. Nopcommerce after 4.50.2 Fix from $1,9502022-10-19 MEDIUM 6.1 CVE-2022-27461 In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafte… Nopcommerce after 4.50.1 Fix from $1,6002022-05-04 HIGH 7.5 CVE-2022-28451 nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature. Nopcommerce Patch available Fix from $1,9502022-05-02 MEDIUM 6.1 CVE-2022-28449 nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). At Apply for vendor account feature, an attacker can upload an arbitrary file to the … Nopcommerce No fix yet Fix from $1,6002022-04-26 MEDIUM 5.4 CVE-2022-28450 nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums) when creating a new post, which allows a remote atta… Nopcommerce No fix yet Fix from $1,6002022-04-26 MEDIUM 5.4 CVE-2022-28448 nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). An attacker (role customer) can inject javascript code to First name or Last name at … Nopcommerce No fix yet Fix from $1,6002022-04-26 MEDIUM 6.1 CVE-2021-26916 In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through th… Nopcommerce No fix yet Fix from $1,6002021-02-08 CRITICAL 9.1 CVE-2019-19683 RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because of Librar… Nopcommerce No fix yet Fix from $2,3002019-12-09 HIGH 8.8 CVE-2019-19684 nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/Facebook… Nopcommerce No fix yet Fix from $1,9502019-12-09 HIGH 8.8 CVE-2019-19685 RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions. Nopcommerce No fix yet Fix from $1,9502019-12-09