Nopcommerce

nopcommerce

23 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (23)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-19683 1Nopcommerce 1Nopcommerce Nov 21, 2024 Dec 9, 2019 N/A· v4 9.1 CRITICAL· v3 9.0 HIGH· v2 RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because of Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs.
CVE-2019-19682 1Nopcommerce 1Nopcommerce Nov 21, 2024 Dec 9, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body...Show more nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/[id] Admin/Blog/BlogPostEdit/[id]. NOTE: the vendor reportedly considers this a "feature" because the affected components are an HTML content editor.Show less
CVE-2019-11519 1Nopcommerce 1Nopcommerce Nov 21, 2024 Apr 25, 2019 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file" screen.