What is the CVSS score of EUVD-2025-199992?

EUVD-2025-199992 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Nopcommerce are affected by EUVD-2025-199992?

nopCommerce installations (v4.70 and earlier, or v4.80.3) fail to invalidate session cookies upon user logout, allowing attackers to maintain unauthorized access to administrative functions even…. A patch is available.

Is there a public PoC exploit available for EUVD-2025-199992?

Yes, a public proof-of-concept exploit is available for EUVD-2025-199992. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2025-199992?

Within 24 hours: Identify all nopCommerce instances and document current versions. Within 7 days: Upgrade all affected instances to v4.80.4 or later (any version above 4.70 except 4.80.3). Within 30 days: Conduct session activity audits for the past 90 days and implement mandatory password resets for all administrative accounts as a precautionary measure.

Nopcommerce EUVD-2025-199992

| CVE-2025-11699 HIGH

Insufficient Session Expiration (CWE-613)

2025-12-01 cret@cert.org

Information Disclosure Nopcommerce

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-199992

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

Patch released

Mar 15, 2026 - 13:34 nvd

Patch available

PoC Detected

Dec 19, 2025 - 17:02 vuln.today

Public exploit code

CVE Published

Dec 01, 2025 - 16:15 nvd

HIGH 7.1

DescriptionCVE.org

nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.

Analysis

Technical ContextAI

This vulnerability is classified as Insufficient Session Expiration (CWE-613).

RemediationAI

A vendor patch is available. Apply it as soon as possible and verify the fix.

EUVD-2025-199992 vulnerability details – vuln.today

Back