CVE-2022-26954

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter, processed by the (1) ChangePassword function, (2) SignInCustomerAsync function, (3) SuccessfulAuthentication method, or (4) NopRedirectResultExecutor class.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/adeadfed/baea45138b7eb29e09f6505d56b56413Exploit, Patch, Third Party Advisory
https://github.com/nopSolutions/nopCommerce/releasesRelease Notes, Third Party Advisory
https://gist.github.com/adeadfed/baea45138b7eb29e09f6505d56b56413Exploit, Patch, Third Party Advisory
https://github.com/nopSolutions/nopCommerce/releasesRelease Notes, Third Party Advisory

Timeline

Published: Oct 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-269599.8There are two full (read/write) Blind/Time-based SQL injection vulnerabilities in the Northstar Club Management version 6.3 application. The CVE-2022-26966.5The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX a CVE-2022-269609.1connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, CVE-2022-269615.4Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMS CVE-2022-269625.4Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announce CVE-2022-269647.5Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-f CVE-2022-269657.2In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.CVE-2022-269665.5An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from h CVE-2022-269677.8GPAC 2.0 allows a heap-based buffer overflow in gf_base64_encode. It can be triggered via MP4Box.CVE-2022-269699.8In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.CVE-2022-26977.5A vulnerability was found in SourceCodester Simple E-Learning System. It has been classified as critical. Affected is an unknown function of CVE-2022-269715.3Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism.