CVE-2022-28448

Name of the Vulnerable Software and Affected Versions nopCommerce version 4.50.1

Description The issue allows an attacker, with the role of a customer, to inject JavaScript code into the First name or Last name fields at Customer Info, enabling Cross Site Scripting (XSS) attacks.

Recommendations For nopCommerce version 4.50.1, as a temporary workaround, consider restricting the input for First name and Last name fields to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.