GCVE - cpe:2.3:a:nopcommerce:nopcommerce:4.20:-:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:nopcommerce:nopcommerce:4.20:-:*:*:*:*:*:*

part: a version: 4.20 update: -

Vendor	Nopcommerce (`31f49e67-f1f3-583d-8ab1-a0a72890a9ba`)
Product	Nopcommerce (`8ae8e9ea-9c0a-5411-b1c1-434095635802`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/nopcommerceteam/nopcommerce`	purl2cpe	2026-06-01 10:17:57.976604
`pkg:github/nopsolutions/nopcommerce`	purl2cpe	2026-06-01 10:17:57.976605
`pkg:nuget/NopCommerce.Core`	purl2cpe	2026-06-01 10:17:57.976607
`pkg:sourceforge/nopcommerce.mirror`	purl2cpe	2026-06-01 10:17:57.976608

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-19685`	vulnerable	2026-06-08 05:13:23.248859	Details available RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions. Published: 2019-12-09T16:58:02.000Z Updated: 2024-08-05T02:25:12.435Z Open on db.gcve.eu Reference links https://github.com/klezVirus/cves/tree/master/NopCommerce/Cross-Site-Request-Forgery	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-19684`	vulnerable	2026-06-08 05:13:23.248533	Details available nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentication/Configure because it is possible to upload a crafted Facebook Auth plugin. Published: 2019-12-09T16:58:12.000Z Updated: 2024-08-05T02:25:12.352Z Open on db.gcve.eu Reference links https://github.com/klezVirus/cves/tree/master/NopCommerce/Privilege%20Escalation%20via%20Plugin%20Upload	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-19683`	vulnerable	2026-06-08 05:13:23.248080	Details available RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because of Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs. Published: 2019-12-09T16:57:13.000Z Updated: 2024-08-05T02:25:12.122Z Open on db.gcve.eu Reference links https://github.com/klezVirus/cves/tree/master/NopCommerce/Privilege%20Escalation%20via%20Path%20Traversal	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-19682`	vulnerable	2026-06-08 05:13:23.247657	Details available nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/[id] Admin/Blog/BlogPostEdit/[id]. NOTE: the vendor reportedly considers this a "feature" because the affected components are an HTML content editor. Published: 2019-12-09T16:58:24.000Z Updated: 2024-08-05T02:25:12.664Z Open on db.gcve.eu Reference links https://github.com/klezVirus/cves/tree/master/NopCommerce/Cross-Site-Scripting	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.