Vulnerabilities > Nopcommerce > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-10-20 | CVE-2022-26954 | Open Redirect vulnerability in Nopcommerce Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter, processed by the (1) ChangePassword function, (2) SignInCustomerAsync function, (3) SuccessfulAuthentication method, or (4) NopRedirectResultExecutor class. | 6.1 |
| 2022-05-04 | CVE-2022-27461 | Open Redirect vulnerability in Nopcommerce In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link. | 6.1 |
| 2022-04-26 | CVE-2022-28449 | Cross-site Scripting vulnerability in Nopcommerce 4.50.1 nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). | 6.1 |
| 2022-04-26 | CVE-2022-28450 | Cross-site Scripting vulnerability in Nopcommerce 4.50.1 nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums) when creating a new post, which allows a remote attacker to execute arbitrary JavaScript code at client browser. | 5.4 |
| 2022-04-26 | CVE-2022-28448 | Cross-site Scripting vulnerability in Nopcommerce 4.50.1 nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). | 5.4 |
| 2021-02-08 | CVE-2021-26916 | Cross-site Scripting vulnerability in Nopcommerce 4.30 In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/CheckDiscountCouponAttribute.cs discountcode parameter. | 6.1 |
| 2020-12-29 | CVE-2020-29475 | Cross-site Scripting vulnerability in Nopcommerce Store 4.30 nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. | 4.8 |
| 2019-12-09 | CVE-2019-19682 | Cross-site Scripting vulnerability in Nopcommerce 4.20 nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/[id] Admin/Blog/BlogPostEdit/[id]. | 4.8 |
| 2019-04-25 | CVE-2019-11519 | XXE vulnerability in Nopcommerce Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file" screen. | 4.9 |