CVE-2025-11699

| EUVD-2025-199992 HIGH
2025-12-01 [email protected]
7.1
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
None

Lifecycle Timeline

5
EUVD ID Assigned
Mar 15, 2026 - 13:34 euvd
EUVD-2025-199992
Analysis Generated
Mar 15, 2026 - 13:34 vuln.today
Patch Released
Mar 15, 2026 - 13:34 nvd
Patch available
PoC Detected
Dec 19, 2025 - 17:02 vuln.today
Public exploit code
CVE Published
Dec 01, 2025 - 16:15 nvd
HIGH 7.1

Tags

Information Disclosure Nopcommerce

Description

nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.

Analysis

nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.

Technical Context

This vulnerability is classified as Insufficient Session Expiration (CWE-613).

Affected Products

Affected products: Nopcommerce Nopcommerce

Remediation

A vendor patch is available. Apply it as soon as possible and verify the fix.

Priority Score

56
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +36
POC: +20

Share

CVE-2025-11699 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy