Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-111278 (GCVE-0-2026-111278)

Vulnerability from nvd – Published: 2026-10-15 21:43 – Updated: 2026-10-16 17:09

Title

NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML

Summary

NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 16:46 UTC

CWE

CWE-804 - Guessable CAPTCHA

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/27	issue-tracking
https://github.com/nivocart/nivocart/blob/5bc2c3f…	technical-description
https://github.com/nivocart/nivocart/blob/5bc2c3f…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.5.1 (semver)

Date Public

2026-10-15 00:00

Credits

Aaron Amran Bin Amiruddin (@aaronamran)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111278",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T16:46:53.427608Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:09:17.598Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aaron Amran Bin Amiruddin (@aaronamran)"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-804",
              "description": "Guessable CAPTCHA",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T21:43:23.205Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #27",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/27"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/information/contact.php#L144-L150"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/view/theme/default/template/information/contact.tpl#L43"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.5.1-captcha-bypass-via-answer-disclosed-in-page-html"
        }
      ],
      "title": "NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111278",
    "datePublished": "2026-10-15T21:43:23.205Z",
    "dateReserved": "2026-10-15T19:46:05.991Z",
    "dateUpdated": "2026-10-16T17:09:17.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111277 (GCVE-0-2026-111277)

Vulnerability from nvd – Published: 2026-10-15 21:43 – Updated: 2026-10-16 14:36

Title

NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download

Summary

NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 14:33 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/26	issue-tracking
https://github.com/nivocart/nivocart/blob/5bc2c3f…	technical-description
https://github.com/nivocart/nivocart/blob/5bc2c3f…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.5.1 (semver)

Date Public

2026-10-15 00:00

Credits

Aaron Amran Bin Amiruddin (@aaronamran)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111277",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:33:36.792608Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T14:36:04.161Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nivocart/nivocart/issues/26"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aaron Amran Bin Amiruddin (@aaronamran)"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T21:43:22.473Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #26",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/26"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/account/order.php#L695-L770"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/model/account/order.php#L11-L12"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.5.1-guest-order-invoice-disclosure-via-account-order-download"
        }
      ],
      "title": "NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111277",
    "datePublished": "2026-10-15T21:43:22.473Z",
    "dateReserved": "2026-10-15T19:46:02.159Z",
    "dateUpdated": "2026-10-16T14:36:04.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94107 (GCVE-0-2026-94107)

Vulnerability from nvd – Published: 2026-09-20 11:09 – Updated: 2026-09-21 16:48

Title

NivoCart through 2.4.0 Predictable Administrator Password Reset Token

Summary

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 16:47 UTC

CWE

CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/25	issue-tracking
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.4.0 (semver)

Date Public

2026-09-19 00:00

Credits

Ikram-4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94107",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T16:47:54.786105Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T16:48:09.091Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator\u0027s email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-338",
              "description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:40.891Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/25"
        },
        {
          "name": "reset token generation at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/forgotten.php#L20-L34"
        },
        {
          "name": "getUserByCode at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/model/user/user.php#L119-L123"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.4.0 Predictable Administrator Password Reset Token",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.4.0-predictable-administrator-password-reset-token"
        }
      ],
      "title": "NivoCart through 2.4.0 Predictable Administrator Password Reset Token",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94107",
    "datePublished": "2026-09-20T11:09:40.891Z",
    "dateReserved": "2026-09-20T10:56:43.733Z",
    "dateUpdated": "2026-09-21T16:48:09.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94105 (GCVE-0-2026-94105)

Vulnerability from nvd – Published: 2026-09-20 11:09 – Updated: 2026-09-21 14:31

Title

NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller

Summary

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 14:28 UTC

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/25	issue-tracking
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.4.0 (semver)

Date Public

2026-09-19 00:00

Credits

Ikram-4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94105",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:28:15.359999Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:31:23.863Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:39.569Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/25"
        },
        {
          "name": "reset.php failure branch at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/reset.php#L93-L99"
        },
        {
          "name": "getUserByCode at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/model/user/user.php#L119-L123"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.4.0-destructive-configuration-write-via-the-password-reset-controller"
        }
      ],
      "title": "NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94105",
    "datePublished": "2026-09-20T11:09:39.569Z",
    "dateReserved": "2026-09-20T10:42:42.395Z",
    "dateUpdated": "2026-09-21T14:31:23.863Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94104 (GCVE-0-2026-94104)

Vulnerability from nvd – Published: 2026-09-20 11:09 – Updated: 2026-09-24 11:52

Title

NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager

Summary

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 11:52 UTC

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/25	issue-tracking
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.4.0 (semver)

Date Public

2026-09-19 00:00

Credits

Ikram-4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94104",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T11:52:29.819478Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T11:52:40.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:38.898Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/25"
        },
        {
          "name": "multi() upload path at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager.php#L527-L562"
        },
        {
          "name": "duplicated file manager controller at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager_full.php"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.4.0-arbitrary-file-upload-rce-via-filemanager"
        }
      ],
      "title": "NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94104",
    "datePublished": "2026-09-20T11:09:38.898Z",
    "dateReserved": "2026-09-20T10:42:42.058Z",
    "dateUpdated": "2026-09-24T11:52:40.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111278 (GCVE-0-2026-111278)

Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 17:09

Title

NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML

Summary

NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 16:46 UTC

CWE

CWE-804 - Guessable CAPTCHA

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/27	issue-tracking
https://github.com/nivocart/nivocart/blob/5bc2c3f…	technical-description
https://github.com/nivocart/nivocart/blob/5bc2c3f…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.5.1 (semver)

Date Public

2026-10-15 00:00

Credits

Aaron Amran Bin Amiruddin (@aaronamran)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111278",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T16:46:53.427608Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:09:17.598Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aaron Amran Bin Amiruddin (@aaronamran)"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-804",
              "description": "Guessable CAPTCHA",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T21:43:23.205Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #27",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/27"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/information/contact.php#L144-L150"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/view/theme/default/template/information/contact.tpl#L43"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.5.1-captcha-bypass-via-answer-disclosed-in-page-html"
        }
      ],
      "title": "NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111278",
    "datePublished": "2026-10-15T21:43:23.205Z",
    "dateReserved": "2026-10-15T19:46:05.991Z",
    "dateUpdated": "2026-10-16T17:09:17.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111277 (GCVE-0-2026-111277)

Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 14:36

Title

NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download

Summary

NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 14:33 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/26	issue-tracking
https://github.com/nivocart/nivocart/blob/5bc2c3f…	technical-description
https://github.com/nivocart/nivocart/blob/5bc2c3f…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.5.1 (semver)

Date Public

2026-10-15 00:00

Credits

Aaron Amran Bin Amiruddin (@aaronamran)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111277",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:33:36.792608Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T14:36:04.161Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nivocart/nivocart/issues/26"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aaron Amran Bin Amiruddin (@aaronamran)"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T21:43:22.473Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #26",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/26"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/account/order.php#L695-L770"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/model/account/order.php#L11-L12"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.5.1-guest-order-invoice-disclosure-via-account-order-download"
        }
      ],
      "title": "NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111277",
    "datePublished": "2026-10-15T21:43:22.473Z",
    "dateReserved": "2026-10-15T19:46:02.159Z",
    "dateUpdated": "2026-10-16T14:36:04.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94107 (GCVE-0-2026-94107)

Vulnerability from cvelistv5 – Published: 2026-09-20 11:09 – Updated: 2026-09-21 16:48

Title

NivoCart through 2.4.0 Predictable Administrator Password Reset Token

Summary

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 16:47 UTC

CWE

CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/25	issue-tracking
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.4.0 (semver)

Date Public

2026-09-19 00:00

Credits

Ikram-4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94107",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T16:47:54.786105Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T16:48:09.091Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator\u0027s email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-338",
              "description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:40.891Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/25"
        },
        {
          "name": "reset token generation at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/forgotten.php#L20-L34"
        },
        {
          "name": "getUserByCode at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/model/user/user.php#L119-L123"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.4.0 Predictable Administrator Password Reset Token",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.4.0-predictable-administrator-password-reset-token"
        }
      ],
      "title": "NivoCart through 2.4.0 Predictable Administrator Password Reset Token",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94107",
    "datePublished": "2026-09-20T11:09:40.891Z",
    "dateReserved": "2026-09-20T10:56:43.733Z",
    "dateUpdated": "2026-09-21T16:48:09.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94105 (GCVE-0-2026-94105)

Vulnerability from cvelistv5 – Published: 2026-09-20 11:09 – Updated: 2026-09-21 14:31

Title

NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller

Summary

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 14:28 UTC

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/25	issue-tracking
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.4.0 (semver)

Date Public

2026-09-19 00:00

Credits

Ikram-4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94105",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:28:15.359999Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:31:23.863Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:39.569Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/25"
        },
        {
          "name": "reset.php failure branch at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/reset.php#L93-L99"
        },
        {
          "name": "getUserByCode at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/model/user/user.php#L119-L123"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.4.0-destructive-configuration-write-via-the-password-reset-controller"
        }
      ],
      "title": "NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94105",
    "datePublished": "2026-09-20T11:09:39.569Z",
    "dateReserved": "2026-09-20T10:42:42.395Z",
    "dateUpdated": "2026-09-21T14:31:23.863Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94104 (GCVE-0-2026-94104)

Vulnerability from cvelistv5 – Published: 2026-09-20 11:09 – Updated: 2026-09-24 11:52

Title

NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager

Summary

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 11:52 UTC

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7818 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/25	issue-tracking
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.4.0 (semver)

Date Public

2026-09-19 00:00

Credits

Ikram-4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94104",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T11:52:29.819478Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T11:52:40.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:38.898Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/25"
        },
        {
          "name": "multi() upload path at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager.php#L527-L562"
        },
        {
          "name": "duplicated file manager controller at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager_full.php"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.4.0-arbitrary-file-upload-rce-via-filemanager"
        }
      ],
      "title": "NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94104",
    "datePublished": "2026-09-20T11:09:38.898Z",
    "dateReserved": "2026-09-20T10:42:42.058Z",
    "dateUpdated": "2026-09-24T11:52:40.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

10 vulnerabilities by nivocart

CVE-2026-111278 (GCVE-0-2026-111278)

CVE-2026-111277 (GCVE-0-2026-111277)

CVE-2026-94107 (GCVE-0-2026-94107)

CVE-2026-94105 (GCVE-0-2026-94105)

CVE-2026-94104 (GCVE-0-2026-94104)

CVE-2026-111278 (GCVE-0-2026-111278)

CVE-2026-111277 (GCVE-0-2026-111277)

CVE-2026-94107 (GCVE-0-2026-94107)

CVE-2026-94105 (GCVE-0-2026-94105)

CVE-2026-94104 (GCVE-0-2026-94104)