Nopcommerce CVE-2019-19684

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2019-12-09 cve@mitre.org

Privilege Escalation File Upload Nopcommerce

8.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Dec 09, 2019 - 17:15 nvd

HIGH 8.8

DescriptionNVD

nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentication/Configure because it is possible to upload a crafted Facebook Auth plugin.

AnalysisAI

nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentication/Configure because it is possible to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentication/Configure because it is possible to upload a crafted Facebook Auth plugin. Affected products include: Nopcommerce.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Nopcommerce

View all

CVE-2019-19683 CRITICAL Act Now POC

RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/Pro

CVE-2019-19685 HIGH This Week POC

RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and

CVE-2025-11699 HIGH This Week POC

nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination

CVE-2022-27461 MEDIUM This Month POC

In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce

CVE-2021-42193 MEDIUM This Month POC

nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]. Each time a user views the prod

CVE-2024-38963 MEDIUM This Month POC

Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined "AddProductReview.Title" and "AddProduct

CVE-2022-26954 MEDIUM This Month POC

Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing att

CVE-2022-28449 MEDIUM This Month POC

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is

CVE-2021-26916 MEDIUM This Month POC

In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary

CVE-2022-28450 MEDIUM This Month POC

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums) when creating a new pos

CVE-2022-28448 MEDIUM This Month POC

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerability is

CVE-2019-11519 MEDIUM This Month POC

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configuration

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all

CVE-2016-3088 CRITICAL POC

CVE-2021-31207 MEDIUM POC

CVE-2017-12617 HIGH POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2024-5084 CRITICAL POC

CVE-2020-36847 CRITICAL POC

CVE-2017-6090 HIGH POC

Same technique Privilege Escalation

View all

CVE-2025-47812 CRITICAL POC

CVE-2013-0422 CRITICAL POC

CVE-2013-0632 CRITICAL POC

CVE-2017-5689 CRITICAL POC

CVE-2017-12635 CRITICAL POC

CVE-2016-10372 CRITICAL POC

CVE-2014-9583 CRITICAL POC

CVE-2012-0297 CRITICAL POC

Share

CVE-2019-19684 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy