PT-2025-51768 · Unknown · Nopcommerce

Published 2025-12-16 · Updated 2025-12-21 · CVE-2025-65589

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions nopCommerce version 4.90.0

Description The software is susceptible to Cross Site Scripting (XSS) through the Attributes functionality. The issue allows for the injection of malicious scripts into web pages viewed by other users.

Recommendations Apply any available updates or patches to address the XSS issue in the Attributes functionality. As a temporary workaround, consider sanitizing all user inputs related to the Attributes functionality to prevent the injection of malicious scripts.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65589

Affected Products

Nopcommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-65589 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65589 · Vendor Advisory
• http://seclists.org/fulldisclosure/2025/Dec/16 · Note
• https://nopcommerce.com · Note
• https://t.me/CVEtracker/39990 · Telegram Post
• https://seclists.org/fulldisclosure/2025/Dec/16 · Note
• https://twitter.com/CVEnew/status/2002857324999008596 · Twitter Post