PT-2025-51771 · Unknown · Nopcommerce

Published 2025-12-16 · Updated 2025-12-21 · CVE-2025-65592

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions nopCommerce version 4.90.0

Description The software contains a Cross Site Scripting (XSS) issue within the product management functionality. Malicious payloads entered into the "Product Name" and "Short Description" fields are saved in the backend database and automatically executed when a user views the affected pages. The vulnerable parameters are Product Name and Short Description.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65592

Affected Products

Nopcommerce

References · 8

• https://osv.dev/vulnerability/CVE-2025-65592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65592 · Security Note
• https://nopcommerce.com · Note
• https://seclists.org/fulldisclosure/2025/Dec/19 · Note
• https://t.me/CVEtracker/39995 · Telegram Post
• https://twitter.com/CVEnew/status/2002857327486202038 · Twitter Post
• http://seclists.org/fulldisclosure/2025/Dec/19 · Note
• https://twitter.com/VulmonFeeds/status/2001175809357197813 · Twitter Post