Nopcommerce vulnerabilities

Products

• Nopcommerce 22

Newest

• nopcommerce nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks... CVE-2025-65593 8.8 HighDecember 16, 2025
• nopcommerce nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management... CVE-2025-65592 6.1 MediumDecember 16, 2025
• nopcommerce nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality. CVE-2025-65591 5.4 MediumDecember 16, 2025
• nopcommerce nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality... CVE-2025-65590 5.4 MediumDecember 16, 2025
• nopcommerce nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality. CVE-2025-65589 6.1 MediumDecember 16, 2025
• nopcommerce CVE-2025-11699 CVE-2025-11699 7.1 HighDecember 1, 2025
• nopcommerce nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]. Each... CVE-2021-42193 6.1 MediumOctober 3, 2025
• nopcommerce nopCommerce before 4.80.0 does not offer locking for order placement. Thus there is a race... CVE-2024-58248 3.5 LowApril 16, 2025
• nopcommerce Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined "AddProductReview... CVE-2024-38963 6.1 MediumJuly 9, 2024
• nopcommerce Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers... CVE-2022-26954 6.1 MediumOctober 20, 2022
• nopcommerce An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any... CVE-2022-33077 7.5 HighOctober 19, 2022
• nopcommerce In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to... CVE-2022-27461 6.1 MediumMay 4, 2022
• nopcommerce nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance... CVE-2022-28451 7.5 HighMay 1, 2022
• nopcommerce nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums)... CVE-2022-28450 5.4 MediumApril 26, 2022
• nopcommerce nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). At Apply for vendor account... CVE-2022-28449 6.1 MediumApril 26, 2022
• nopcommerce nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). An attacker (role customer) can... CVE-2022-28448 5.4 MediumApril 26, 2022
• nopcommerce In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote... CVE-2021-26916 6.1 MediumFebruary 8, 2021
• nopcommerce store nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field... CVE-2020-29475 Public exploit 4.8 MediumDecember 29, 2020
• nopcommerce nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop... CVE-2019-19682 4.8 MediumDecember 9, 2019
• nopcommerce nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin... CVE-2019-19684 8.8 HighDecember 9, 2019
• nopcommerce RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can... CVE-2019-19685 8.8 HighDecember 9, 2019
• nopcommerce RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f... CVE-2019-19683 9.1 CriticalDecember 9, 2019
• nopcommerce Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE... CVE-2019-11519 4.9 MediumApril 25, 2019