GCVE - cpe:2.3:a:nopcommerce:nopcommerce:4.90.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:nopcommerce:nopcommerce:4.90.0:*:*:*:*:*:*:*

part: a version: 4.90.0 update: *

Vendor	Nopcommerce (`31f49e67-f1f3-583d-8ab1-a0a72890a9ba`)
Product	Nopcommerce (`8ae8e9ea-9c0a-5411-b1c1-434095635802`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:docker/nopcommerceteam/nopcommerce`	purl2cpe	2026-06-01 10:17:58.002202
`pkg:github/nopsolutions/nopcommerce`	purl2cpe	2026-06-01 10:17:58.002204
`pkg:nuget/NopCommerce.Core`	purl2cpe	2026-06-01 10:17:58.002205
`pkg:sourceforge/nopcommerce.mirror`	purl2cpe	2026-06-01 10:17:58.002207

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-65593`	vulnerable	2026-06-08 07:39:20.928320	Details available nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality. Published: 2025-12-16T00:00:00.000Z Updated: 2025-12-17T14:40:43.687Z Open on db.gcve.eu Reference links https://www.nopcommerce.com/ https://seclists.org/fulldisclosure/2025/Dec/20	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-65592`	vulnerable	2026-06-08 07:39:20.927893	Details available nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages. Published: 2025-12-16T00:00:00.000Z Updated: 2025-12-17T18:51:27.613Z Open on db.gcve.eu Reference links https://www.nopcommerce.com/ https://seclists.org/fulldisclosure/2025/Dec/19	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-65591`	vulnerable	2026-06-08 07:39:20.927528	Details available nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality. Published: 2025-12-16T00:00:00.000Z Updated: 2025-12-16T19:47:55.318Z Open on db.gcve.eu Reference links https://www.nopcommerce.com/ https://seclists.org/fulldisclosure/2025/Dec/18	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-65590`	vulnerable	2026-06-08 07:39:20.927253	Details available nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area. Published: 2025-12-16T00:00:00.000Z Updated: 2025-12-16T19:46:56.722Z Open on db.gcve.eu Reference links https://www.nopcommerce.com/ https://seclists.org/fulldisclosure/2025/Dec/17	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-65589`	vulnerable	2026-06-08 07:39:20.926784	Details available nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality. Published: 2025-12-16T00:00:00.000Z Updated: 2025-12-17T18:51:34.108Z Open on db.gcve.eu Reference links https://www.nopcommerce.com/ https://seclists.org/fulldisclosure/2025/Dec/16	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.