Vulnerabilities > Nopcommerce > Nopcommerce > 4.40.2

DATE CVE VULNERABILITY TITLE RISK
2022-10-20 CVE-2022-26954 Open Redirect vulnerability in Nopcommerce
Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter, processed by the (1) ChangePassword function, (2) SignInCustomerAsync function, (3) SuccessfulAuthentication method, or (4) NopRedirectResultExecutor class.
network
low complexity
nopcommerce CWE-601
6.1
6.1
2022-10-19 CVE-2022-33077 Authorization Bypass Through User-Controlled Key vulnerability in Nopcommerce
An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint.
network
low complexity
nopcommerce CWE-639
7.5
7.5
2022-05-04 CVE-2022-27461 Open Redirect vulnerability in Nopcommerce
In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link. 		5.8
5.8