CVE-2025-11699

HighCVSS 7.1/10Last modified Oct 18, 2026

Description

nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: Dec 1, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-11705.4A vulnerability classified as problematic has been found in code-projects Real Estate Property Management System 1.0. Affected is an unknown CVE-2025-117007.5N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure CVE-2025-117015.3The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing p CVE-2025-117028.8GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could h CVE-2025-117035.3The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48.CVE-2025-117047.5The Elegance Menu plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the 'elegance-men CVE-2025-117056.5The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and incl CVE-2025-117066.1The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the dbstatus parameter in all versions up t CVE-2025-117075.3The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is du CVE-2025-117089.8Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and T CVE-2025-117099.8A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. CVE-2025-11716.1A vulnerability classified as problematic was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerabil