CVE-2025-65592

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://seclists.org/fulldisclosure/2025/Dec/19	Mailing List Third Party Advisory
https://www.nopcommerce.com/	Product
http://seclists.org/fulldisclosure/2025/Dec/19	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nopcommerce:nopcommerce:4.90.0:*:*:*:*:*:*:*

History

05 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) nopCommerce 4.90.0 es vulnerable a Cross Site Scripting (XSS) en la funcionalidad de gestión de productos. Las cargas útiles maliciosas insertadas en los campos 'Product Name' y 'Short Description' se almacenan en la base de datos del backend y se ejecutan automáticamente cada vez que un usuario ve las páginas afectadas.

Information

Published : 2025-12-16 19:15

Updated : 2026-10-13 11:10

NVD link : CVE-2025-65592

Mitre link : CVE-2025-65592

CVE.ORG link : CVE-2025-65592

JSON object : View

Products Affected

nopcommerce

nopcommerce

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-65592", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65592", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-17T15:36:53.540051Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-16T19:15:58.967", "references": [{"url": "https://seclists.org/fulldisclosure/2025/Dec/19", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.nopcommerce.com/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2025/Dec/19", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the \"Product Name\" and \"Short Description\" fields are stored in the backend database and executed automatically whenever a user views the affected pages."}, {"lang": "es", "value": "nopCommerce 4.90.0 es vulnerable a Cross Site Scripting (XSS) en la funcionalidad de gesti\u00f3n de productos. Las cargas \u00fatiles maliciosas insertadas en los campos 'Product Name' y 'Short Description' se almacenan en la base de datos del backend y se ejecutan autom\u00e1ticamente cada vez que un usuario ve las p\u00e1ginas afectadas."}], "lastModified": "2026-10-13T11:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nopcommerce:nopcommerce:4.90.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FC64557-EDFD-4460-8793-8C452638D782"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}