PT-2025-48449 · Unknown · Nopcommerce

Beafn28 + 1 · Published 2025-12-01 · Updated 2026-01-06 · CVE-2025-11699

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions nopCommerce versions prior to 4.80.3

Description The software does not invalidate session cookies after logout or session termination. This allows an attacker with a valid session cookie to access privileged endpoints, such as '/admin', even after the legitimate user has logged out, potentially enabling session hijacking. Approximately 40.8k instances are exposed. The issue allows attackers to reuse expired session cookies due to a logout flaw, potentially leading to account hijacking, including administrative access.

Recommendations Versions prior to 4.80.3 should be updated to version 4.80.3 or later.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2025-11699

Affected Products

Nopcommerce

References · 13

• https://osv.dev/vulnerability/CVE-2025-11699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11699 · Security Note
• https://kb.cert.org/vuls/id/633103 · Patch
• https://github.com/nopSolutions/nopCommerce/issues/7044 · Note
• https://twitter.com/zoomeye_team/status/1995769697724223724 · Twitter Post
• https://t.me/netlas/519 · Telegram Post
• https://twitter.com/Karma_X_Inc/status/1995905719221072003 · Twitter Post
• https://twitter.com/CVEnew/status/1995519582530912568 · Twitter Post
• https://nopcommerce.com/en/release-notes?srsltid=AfmBOoravPKjN19pm_XZbXZ7GvPhkt8cxlK6794BJRZlY5RxJU_yNoTT · Note
• https://t.me/pentestingnews/71339 · Telegram Post
• https://twitter.com/Komodosec/status/2008616127312867461 · Twitter Post
• https://t.me/cveNotify/146355 · Telegram Post
• https://seclists.org/fulldisclosure/2025/Aug/14 · Note