Filtered by vendor Nopcommerce
Subscriptions
Filtered by product Nopcommerce
Subscriptions
Total
13 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-19682 | 1 Nopcommerce | 1 Nopcommerce | 2024-08-05 | 4.8 Medium |
| nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/[id] Admin/Blog/BlogPostEdit/[id]. NOTE: the vendor reportedly considers this a "feature" because the affected components are an HTML content editor. | ||||
| CVE-2019-19685 | 1 Nopcommerce | 1 Nopcommerce | 2024-08-05 | 8.8 High |
| RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions. | ||||
| CVE-2019-19684 | 1 Nopcommerce | 1 Nopcommerce | 2024-08-05 | 8.8 High |
| nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentication/Configure because it is possible to upload a crafted Facebook Auth plugin. | ||||
| CVE-2019-19683 | 1 Nopcommerce | 1 Nopcommerce | 2024-08-05 | 9.1 Critical |
| RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because of Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs. | ||||
| CVE-2019-11519 | 1 Nopcommerce | 1 Nopcommerce | 2024-08-04 | N/A |
| Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file" screen. | ||||
| CVE-2021-26916 | 1 Nopcommerce | 1 Nopcommerce | 2024-08-03 | 6.1 Medium |
| In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/CheckDiscountCouponAttribute.cs discountcode parameter. | ||||
| CVE-2022-33077 | 1 Nopcommerce | 1 Nopcommerce | 2024-08-03 | 7.5 High |
| An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint. | ||||
| CVE-2022-28449 | 1 Nopcommerce | 1 Nopcommerce | 2024-08-03 | 6.1 Medium |
| nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). At Apply for vendor account feature, an attacker can upload an arbitrary file to the system. | ||||
| CVE-2022-28448 | 1 Nopcommerce | 1 Nopcommerce | 2024-08-03 | 5.4 Medium |
| nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). An attacker (role customer) can inject javascript code to First name or Last name at Customer Info. | ||||
| CVE-2022-28451 | 1 Nopcommerce | 1 Nopcommerce | 2024-08-03 | 7.5 High |
| nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature. | ||||
| CVE-2022-28450 | 1 Nopcommerce | 1 Nopcommerce | 2024-08-03 | 5.4 Medium |
| nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums) when creating a new post, which allows a remote attacker to execute arbitrary JavaScript code at client browser. | ||||
| CVE-2022-27461 | 1 Nopcommerce | 1 Nopcommerce | 2024-08-03 | 6.1 Medium |
| In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link. | ||||
| CVE-2022-26954 | 1 Nopcommerce | 1 Nopcommerce | 2024-08-03 | 6.1 Medium |
| Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter, processed by the (1) ChangePassword function, (2) SignInCustomerAsync function, (3) SuccessfulAuthentication method, or (4) NopRedirectResultExecutor class. | ||||
Page 1 of 1.