← Back

Nopcommerce

nopcommerce

Vendor: Nopcommerce • 22 CVEs

CVEs (22)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-19682
1Nopcommerce
1Nopcommerce
Nov 21, 2024
Dec 9, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body...Show more
nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/[id] Admin/Blog/BlogPostEdit/[id]. NOTE: the vendor reportedly considers this a "feature" because the affected components are an HTML content editor.Show less
CVE-2019-11519
1Nopcommerce
1Nopcommerce
Nov 21, 2024
Apr 25, 2019
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file" screen.