CVE-2025-65592

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-65592

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65592.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-65592

Published

2025-12-16T00:00:00Z

Modified

2026-07-15T01:48:54.129096026Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65592.json"
}

References

Affected packages

Git / github.com/nopsolutions/nopcommerce

Affected ranges

Type

GIT

Repo

https://github.com/nopsolutions/nopcommerce

Events

Introduced

e7a52b9199f9c7651839e92826df47f668f3c767

Last affected

e7a52b9199f9c7651839e92826df47f668f3c767

Database specific

Show details

{
    "cpe": "cpe:2.3:a:nopcommerce:nopcommerce:4.90.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.90.0"
        },
        {
            "last_affected": "4.90.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

4.*

4.90.0

release-4.*

release-4.90.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65592.json"