Description

nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.

INFO

Published Date :

2025-12-01T15:17:57.842Z

Last Modified :

2025-12-01T18:45:07.246Z

Source :

certcc
AFFECTED PRODUCTS

The following products are affected by CVE-2025-11699 vulnerability.

Vendors Products
Nopcommerce
  • Nopcommerce
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-11699.

URL Resource
https://github.com/nopSolutions/nopCommerce/issues/7044 cve-icon cve-icon
https://seclists.org/fulldisclosure/2025/Aug/14 cve-icon cve-icon
https://www.kb.cert.org/vuls/id/633103 cve-icon
https://www.nopcommerce.com/en/release-notes?srsltid=AfmBOoravPKjN19pm_XZbXZ7GvPhkt8cxlK6794BJRZlY5RxJU_yNoTT cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact