{"schema_version":1,"title":"nopCommerce vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 7 vulnerabilities in nopCommerce: 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2025-65593, was published on 16 December 2025.","url":"https://junglewise.ai/threats/technologies/nopcommerce","json_url":"https://junglewise.ai/threats/technologies/nopcommerce.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/nopcommerce","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":true,"counts":{"high":2,"all_time":7,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":6},"latest":[{"cve":"CVE-2025-65593","cvss":8.8,"epss":0.0029,"slug":"cve-2025-65593-nopcommerce-4-90-0-is-vulnerable-to-cross-site-request-forgery","title":"nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality.","severity":"high","exploited":false,"published_at":"2025-12-16T19:15:59.08+00:00","url":"https://junglewise.ai/threats/cve-2025-65593-nopcommerce-4-90-0-is-vulnerable-to-cross-site-request-forgery"},{"cve":"CVE-2025-65592","cvss":6.1,"epss":0.0026,"slug":"cve-2025-65592-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-in","title":"nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious…","severity":"medium","exploited":false,"published_at":"2025-12-16T19:15:58.967+00:00","url":"https://junglewise.ai/threats/cve-2025-65592-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-in"},{"cve":"CVE-2025-65591","cvss":5.4,"epss":0.0024,"slug":"cve-2025-65591-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-via","title":"nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.","severity":"medium","exploited":false,"published_at":"2025-12-16T19:15:58.85+00:00","url":"https://junglewise.ai/threats/cve-2025-65591-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-via"},{"cve":"CVE-2025-65590","cvss":5.4,"epss":0.0023,"slug":"cve-2025-65590-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-via","title":"nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area.","severity":"medium","exploited":false,"published_at":"2025-12-16T19:15:58.73+00:00","url":"https://junglewise.ai/threats/cve-2025-65590-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-via"},{"cve":"CVE-2025-65589","cvss":6.1,"epss":0.0036,"slug":"cve-2025-65589-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-via","title":"nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality.","severity":"medium","exploited":false,"published_at":"2025-12-16T18:16:14.937+00:00","url":"https://junglewise.ai/threats/cve-2025-65589-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-via"},{"cve":"CVE-2025-11699","cvss":7.1,"epss":0.0043,"slug":"cve-2025-11699-nopcommerce-v4-70-and-prior-and-version-4-80-3-does-not","title":"nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session…","severity":"high","exploited":false,"published_at":"2025-12-01T16:15:51.017+00:00","url":"https://junglewise.ai/threats/cve-2025-11699-nopcommerce-v4-70-and-prior-and-version-4-80-3-does-not"},{"cve":"CVE-2021-42193","cvss":6.1,"epss":0.0027,"slug":"cve-2021-42193-nopcommerce-stored-xss-in-product-name-field","title":"nopCommerce stored XSS in Product Name field","severity":"medium","exploited":false,"published_at":"2025-10-03T17:15:45.883+00:00","url":"https://junglewise.ai/threats/cve-2021-42193-nopcommerce-stored-xss-in-product-name-field"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"nopCommerce","slug":"nopcommerce","vendor":{"hub":true,"name":"Nopcommerce","slug":"nopcommerce","url":"https://junglewise.ai/threats/vendors/nopcommerce"},"aliases":[],"category":"cms","homepage":"https://www.nopcommerce.com/","repo_url":"https://github.com/nopSolutions/nopCommerce","description":"nopCommerce is an open-source e-commerce solution based on ASP.NET Core.","url":"https://junglewise.ai/threats/technologies/nopcommerce"},"most_severe":[{"cve":"CVE-2025-65593","cvss":8.8,"epss":0.0029,"slug":"cve-2025-65593-nopcommerce-4-90-0-is-vulnerable-to-cross-site-request-forgery","title":"nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality.","severity":"high","exploited":false,"published_at":"2025-12-16T19:15:59.08+00:00","url":"https://junglewise.ai/threats/cve-2025-65593-nopcommerce-4-90-0-is-vulnerable-to-cross-site-request-forgery"},{"cve":"CVE-2025-11699","cvss":7.1,"epss":0.0043,"slug":"cve-2025-11699-nopcommerce-v4-70-and-prior-and-version-4-80-3-does-not","title":"nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session…","severity":"high","exploited":false,"published_at":"2025-12-01T16:15:51.017+00:00","url":"https://junglewise.ai/threats/cve-2025-11699-nopcommerce-v4-70-and-prior-and-version-4-80-3-does-not"},{"cve":"CVE-2025-65589","cvss":6.1,"epss":0.0036,"slug":"cve-2025-65589-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-via","title":"nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality.","severity":"medium","exploited":false,"published_at":"2025-12-16T18:16:14.937+00:00","url":"https://junglewise.ai/threats/cve-2025-65589-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-via"},{"cve":"CVE-2021-42193","cvss":6.1,"epss":0.0027,"slug":"cve-2021-42193-nopcommerce-stored-xss-in-product-name-field","title":"nopCommerce stored XSS in Product Name field","severity":"medium","exploited":false,"published_at":"2025-10-03T17:15:45.883+00:00","url":"https://junglewise.ai/threats/cve-2021-42193-nopcommerce-stored-xss-in-product-name-field"},{"cve":"CVE-2025-65592","cvss":6.1,"epss":0.0026,"slug":"cve-2025-65592-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-in","title":"nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious…","severity":"medium","exploited":false,"published_at":"2025-12-16T19:15:58.967+00:00","url":"https://junglewise.ai/threats/cve-2025-65592-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-in"},{"cve":"CVE-2025-65591","cvss":5.4,"epss":0.0024,"slug":"cve-2025-65591-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-via","title":"nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.","severity":"medium","exploited":false,"published_at":"2025-12-16T19:15:58.85+00:00","url":"https://junglewise.ai/threats/cve-2025-65591-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-via"},{"cve":"CVE-2025-65590","cvss":5.4,"epss":0.0023,"slug":"cve-2025-65590-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-via","title":"nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area.","severity":"medium","exploited":false,"published_at":"2025-12-16T19:15:58.73+00:00","url":"https://junglewise.ai/threats/cve-2025-65590-nopcommerce-4-90-0-is-vulnerable-to-cross-site-scripting-xss-via"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}