CVE-2025-65592 Details
Description
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages.
A stored cross-site scripting vulnerability has been identified in nopCommerce version 4.90.0, specifically within the product management feature. This issue allows malicious JavaScript payloads inserted into the 'Product Name' and 'Short Description' fields to be saved in the backend database. The injected scripts are automatically executed when a user, whether an administrator or a customer, views the affected product pages.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://seclists.org/fulldisclosure/2025/Dec/19 | CVE | Mailing ListThird Party Advisory |
| https://seclists.org/fulldisclosure/2025/Dec/19 | [email protected] | Mailing ListThird Party Advisory |
| https://www.nopcommerce.com/ | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| nopcommerce nopcommerce | 4.90.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 19, 2025 | Initial Analysis | [email protected] |
| Dec 17, 2025 | CVE Modified | CISA-ADP |
| Dec 16, 2025 | New CVE Received | [email protected] |
| Dec 16, 2025 | CVE Modified | CVE |