AttackFeed by Joe Wagner | nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality  - Full Disclosure

nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality  – Full Disclosure

Posted on By Joe-W No Comments on nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality  – Full Disclosure
Alert Feeds

 

Posted by Onur Tezcan via Fulldisclosure on Dec 15

[Attack Vectors]
      > It was identified Cross-Site Request Forgery (CSRF) vulnerability on the “Run now” button of Schedule tasks
functionality. Exploiting this vulnerability, an attacker can run a scheduled task without the victim users consent or
knowledge.

Assigned CVE code:
      > CVE-2025-65593

[Discoverer]
      > AlterSec t/a PenTest.NZ
 – Read More  – Full Disclosure 

You may also like

Alert Feeds
[SYSS-2025-017]: Verbatim Store ‘n’ Go Secure Portable HDD (security update v1.0.0.6) – Offline brute-force attack  – Full Disclosure
October 21, 2025
Alert Feeds
CVE-2024-45438 – SpamTitan Unauthenticated User Creation  – Full Disclosure
September 8, 2025
Alert Feeds
APPLE-SA-11-03-2025-5 tvOS 26.1  – Full Disclosure
November 7, 2025
Alert Feeds
APPLE-SA-09-29-2025-1 iOS 26.0.1 and iPadOS 26.0.1  – Full Disclosure
September 30, 2025

Leave a Reply

AttackFeed by Joe Wagner
Powered by  GDPR Cookie Compliance
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.