Nopcommerce
Approved changes feed: RSS · Atom
cpe:2.3:a:nopsolutions:nopcommerce:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Nopsolutions (d9fea595-0441-53ea-838c-83c9e3444d05) |
|---|---|
| Product | Nopcommerce (c713458d-40a6-5362-9a74-17a88b3d5aec) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-117605 |
vulnerable | 2026-11-03 10:15:33.496103 |
nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers
MEDIUM (4.3)
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
Published: 2026-10-28T02:03:15.191Z
Updated: 2026-10-28T16:12:20.568Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11699 |
vulnerable | 2026-06-08 07:04:28.783248 |
CVE-2025-11699
nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a
a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.
Published: 2025-12-01T15:17:57.842Z
Updated: 2025-12-01T18:45:07.246Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.