CVE-2019-19684: Nopcommerce

High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days.

nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentication/Configure because it is possible to upload a crafted Facebook Auth plugin.

Affected products

• Nopcommerce Nopcommerce: version 4.20 only

Published 2019-12-09. Last modified 2026-06-17.