VULNERABILITY INTELLIGENCE

CVE-2025-65592

CVSS score6.1 MEDIUM

EPSS probability0.26%

CISA KEVNot currently listed

Published2025-12-16

Last modified2026-10-13

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages.

Weakness classification

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79

Primary references

cve@mitre.org — Mailing List, Third Party Advisory
cve@mitre.org — Product
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory