Vulnerabilities > Nopcommerce > Nopcommerce > 4.50.1
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-10-20 | CVE-2022-26954 | Open Redirect vulnerability in Nopcommerce Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter, processed by the (1) ChangePassword function, (2) SignInCustomerAsync function, (3) SuccessfulAuthentication method, or (4) NopRedirectResultExecutor class. | 6.1 |
| 2022-10-19 | CVE-2022-33077 | Authorization Bypass Through User-Controlled Key vulnerability in Nopcommerce An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint. | 7.5 |
| 2022-05-04 | CVE-2022-27461 | Open Redirect vulnerability in Nopcommerce In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link. | 5.8 |
| 2022-05-02 | CVE-2022-28451 | Path Traversal vulnerability in Nopcommerce 4.50.1 nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature. | 5.0 |
| 2022-04-26 | CVE-2022-28449 | Cross-site Scripting vulnerability in Nopcommerce 4.50.1 nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). | 4.3 |
| 2022-04-26 | CVE-2022-28450 | Cross-site Scripting vulnerability in Nopcommerce 4.50.1 nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums) when creating a new post, which allows a remote attacker to execute arbitrary JavaScript code at client browser. | 3.5 |
| 2022-04-26 | CVE-2022-28448 | Cross-site Scripting vulnerability in Nopcommerce 4.50.1 nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). | 3.5 |