Medium severity6.1OSV Advisory· Published Dec 16, 2025· Updated Jun 17, 2026
CVE-2025-65592
CVE-2025-65592
Description
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: release-1.70, release-1.80, release-1.90, …
cpe:2.3:a:nopcommerce:nopcommerce:4.90.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:nopcommerce:nopcommerce:4.90.0:*:*:*:*:*:*:*
- (no CPE)range: =4.90.0
Patches
Vulnerability mechanics
References
3- seclists.org/fulldisclosure/2025/Dec/19nvdMailing ListThird Party Advisory
- seclists.org/fulldisclosure/2025/Dec/19nvdMailing ListThird Party Advisory
- www.nopcommerce.comnvdProduct
News mentions
0No linked articles in our index yet.