Threats tagged 'ghsa-62cg-2vpq-h2g2'

nopCommerce versions before 5.00.0 have a missing authorization vulnerability in the admin ProductController handlers RelatedProductAddPopup, CrossSellProductAddPopup, and AssociatedProductAddPopup. This flaw allows authenticated vendors to submit another vendor's product ID to inject their products into the victim's related, cross-sell, and grouped product listings.