nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.
嗯，用户让我帮忙总结一下这篇文章的内容，控制在一百个字以内。首先，我需要仔细阅读文章内容，找出关键信息。 文章标题是“Full Disclosure”，看起来是一个安全邮件列表的存档。发件人是Onur Tezcan，日期是2025年12月12日。内容主要讨论了一个安全漏洞，具体来说是一个存储型XSS漏洞。 漏洞出现在nopCommerce 4.90.0版本的“Currencies”功能中，特别是在“Custom formatting”输入字段。攻击者可以利用这个漏洞在保存payload后触发XSS攻击。触发页面包括Bestsellers、Sales > Orders以及通过商店应用查看产品时。 文章还提到了CVE编号是CVE-2025-65591，发现者是AlterSec t/a PenTest.NZ。 接下来，我需要将这些信息浓缩到100字以内。重点包括：nopCommerce 4.90.0版本存在XSS漏洞，位置在Currencies的Custom formatting字段，触发页面有多个，并且有CVE编号和发现者信息。 最后，确保语言简洁明了，不使用复杂的术语，直接描述漏洞情况。 </think> nopCommerce 4.90.0 存在 XSS 漏洞，源于 "Currencies" 功能中的 "Custom formatting" 输入字段。攻击者可利用此漏洞在 Bestsellers、Sales > Orders 页面及产品详情页触发脚本执行。该漏洞已分配 CVE-2025-65591 编号，由 AlterSec t/a PenTest.NZ 发现。 2025-12-16 05:19:10 Author: seclists.org(查看原文) 阅读量:3 收藏
fulldisclosure logo

Full Disclosure mailing list archives

From: Onur Tezcan via Fulldisclosure <fulldisclosure () seclists org>
Date: Fri, 12 Dec 2025 15:04:09 +0000
 [Attack Vectors]
      > It was detected that a Stored XSS vulnerability on the "Currencies" functionality, specifically on the 
following input field: "Configuration > Currencies > Edit one of the currencies > "Custom formatting" input field. 
After saving the payload, the vulnerability can be triggered by visiting the following pages:
 - Bestsellers,
 - "Sales" > "Orders"
 - Also when someone views one of the products via the shop application the payload is triggered.

Assigned CVE code:
       > CVE-2025-65591

 [Discoverer]
      > AlterSec t/a PenTest.NZ


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

  • nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality. Onur Tezcan via Fulldisclosure (Dec 15)

文章来源: https://seclists.org/fulldisclosure/2025/Dec/18
如有侵权请联系:admin#unsafe.sh