VulnerabilityAnalyzed
CVE-2025-65592
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality.
MEDIUM 6.1EPSS 0.26%
Does this matter?
Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.
Description
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.26% probability · 18th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- nopcommerce/nopcommerce
- Source
- cve@mitre.org
References
- https://seclists.org/fulldisclosure/2025/Dec/19Mailing List, Third Party Advisory
- https://www.nopcommerce.com/Product
- http://seclists.org/fulldisclosure/2025/Dec/19Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.