İçeriğe atla
Noroxi

nopCommerce kayıtları

nopcommerce üreticisine ait 23 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
0 · %0
Pre-auth RCE
0
Düzeltme kaydı olan
%4,3
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 19
  2. 20
  3. 21
  4. 22
  5. 24
  6. 25

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

23 kayıt
  • CVE-2019-19683
    37İzleyin

    RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because

    KritikCVSS 9,1İstismar yokEPSS %1

    nopcommerce · nopcommerce9 Ara 2019

  • CVE-2019-19684
    35İzleyin

    nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin

    YüksekCVSS 8,8İstismar yokEPSS %1

    nopcommerce · nopcommerce9 Ara 2019

  • CVE-2019-19685
    35İzleyin

    RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions.

    YüksekCVSS 8,8İstismar yokEPSS %0

    nopcommerce · nopcommerce9 Ara 2019

  • CVE-2025-65593
    35İzleyin

    nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality.

    YüksekCVSS 8,8İstismar yokEPSS %0

    nopcommerce · nopcommerce16 Ara 2025

  • CVE-2022-28451
    30İzleyin

    nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature.

    YüksekCVSS 7,5İstismar yokEPSS %1

    nopcommerce · nopcommerce1 May 2022

  • CVE-2022-33077
    30İzleyin

    An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint.

    YüksekCVSS 7,5İstismar yokEPSS %0

    nopcommerce · nopcommerce18 Eki 2022

  • CVE-2025-11699
    28İzleyin

    nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attack

    YüksekCVSS 7,1İstismar yokEPSS %0

    nopcommerce · nopcommerce1 Ara 2025

  • CVE-2021-26916
    24İzleyin

    In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML t

    OrtaCVSS 6,1İstismar yokEPSS %1

    nopcommerce · nopcommerce8 Şub 2021

  • CVE-2022-26954
    24İzleyin

    Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting

    OrtaCVSS 6,1İstismar yokEPSS %0

    nopcommerce · nopcommerce20 Eki 2022

  • CVE-2022-28449
    24İzleyin

    nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS).

    OrtaCVSS 6,1İstismar yokEPSS %0

    nopcommerce · nopcommerce26 Nis 2022

  • CVE-2022-27461
    24İzleyin

    In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on

    OrtaCVSS 6,1İstismar yokEPSS %0

    nopcommerce · nopcommerce4 May 2022

  • CVE-2025-65589
    24İzleyin

    nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality.

    OrtaCVSS 6,1İstismar yokEPSS %0

    nopcommerce · nopcommerce16 Ara 2025

  • CVE-2024-38963
    24İzleyin

    Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined "AddProductReview.Title" and "AddProductReview.ReviewText" p

    OrtaCVSS 6,1İstismar yokEPSS %0

    nopcommerce · nopcommerce9 Tem 2024

  • CVE-2025-65592
    24İzleyin

    nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality.

    OrtaCVSS 6,1İstismar yokEPSS %0

    nopcommerce · nopcommerce16 Ara 2025

  • CVE-2021-42193
    24İzleyin

    nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id].

    OrtaCVSS 6,1İstismar yokEPSS %0

    nopcommerce · nopcommerce3 Eki 2025

  • CVE-2022-28450
    21İzleyin

    nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums) when creating a new post, which allows a re

    OrtaCVSS 5,4İstismar yokEPSS %0

    nopcommerce · nopcommerce26 Nis 2022

  • CVE-2022-28448
    21İzleyin

    nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS).

    OrtaCVSS 5,4İstismar yokEPSS %0

    nopcommerce · nopcommerce26 Nis 2022

  • CVE-2025-65591
    21İzleyin

    nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.

    OrtaCVSS 5,4İstismar yokEPSS %0

    nopcommerce · nopcommerce16 Ara 2025

  • CVE-2025-65590
    21İzleyin

    nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area.

    OrtaCVSS 5,4İstismar yokEPSS %0

    nopcommerce · nopcommerce16 Ara 2025

  • CVE-2019-11519
    19İzleyin

    Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Ed

    OrtaCVSS 4,9İstismar yokEPSS %1

    nopcommerce · nopcommerce25 Nis 2019

  • CVE-2020-29475
    19İzleyin

    nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field.

    OrtaCVSS 4,8Kavram kanıtıEPSS %1

    nopcommerce · store29 Ara 2020

  • CVE-2019-19682
    19İzleyin

    nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.

    OrtaCVSS 4,8İstismar yokEPSS %0

    nopcommerce · nopcommerce9 Ara 2019

  • CVE-2024-58248
    14İzleyin

    nopCommerce through 4.90.1 does not offer locking for order placement.

    DüşükCVSS 3,5İstismar yokEPSS %0

    nopcommerce · nopcommerce16 Nis 2025