RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions.

Published Dec 9, 2019 · Updated Aug 5, 2024 · Assigned by mitre