CVE-2025-65593 | High | 8.8 | 2025-12-16 | nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality. |
CVE-2025-65592 | Medium | 6.1 | 2025-12-16 | nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and… |
CVE-2025-65591 | Medium | 5.4 | 2025-12-16 | nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality. |
CVE-2025-65590 | Medium | 5.4 | 2025-12-16 | nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area. |
CVE-2025-65589 | Medium | 6.1 | 2025-12-16 | nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality. |
CVE-2025-11699 | High | 7.1 | 2025-12-01 | nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a
a va… |
CVE-2021-42193 | Medium | 6.1 | 2025-10-03 | nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]. Each time a user views the product in the shop, the XSS payload fires. |
CVE-2024-58248 | Low | 3.5 | 2025-04-16 | nopCommerce through 4.90.1 does not offer locking for order placement. Thus there is a race condition with duplicate redeeming of gift cards. |
CVE-2024-38963 | Medium | 6.1 | 2024-07-09 | Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined "AddProductReview.Title" and "AddProductReview.ReviewText" parameter(s) (Review… |
CVE-2022-26954 | Medium | 6.1 | 2022-10-20 | Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-c… |
CVE-2022-33077 | High | 7.5 | 2022-10-19 | An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint. |
CVE-2022-27461 | Medium | 6.1 | 2022-05-04 | In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link. |
CVE-2022-28451 | High | 7.5 | 2022-05-02 | nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature. |
CVE-2022-28450 | Medium | 5.4 | 2022-04-26 | nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums) when creating a new post, which allows a remote attacker to ex… |
CVE-2022-28449 | Medium | 6.1 | 2022-04-26 | nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). At Apply for vendor account feature, an attacker can upload an arbitrary file to the system. |
CVE-2022-28448 | Medium | 5.4 | 2022-04-26 | nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). An attacker (role customer) can inject javascript code to First name or Last name at Customer I… |
CVE-2021-26916 | Medium | 6.1 | 2021-02-08 | In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/… |
CVE-2020-29475 | Medium | 4.8 | 2020-12-29 | nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability can allow an attacker to inject the XSS p… |
CVE-2019-19685 | High | 8.8 | 2019-12-09 | RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions. |
CVE-2019-19684 | High | 8.8 | 2019-12-09 | nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentica… |
CVE-2019-19683 | Critical | 9.1 | 2019-12-09 | RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because of Libraries/Nop.Se… |
CVE-2019-19682 | Medium | 4.8 | 2019-12-09 | nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentatio… |
CVE-2019-11519 | Medium | 4.9 | 2019-04-25 | Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Impo… |