Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-94107 (GCVE-0-2026-94107)

Vulnerability from nvd – Published: 2026-09-20 11:09 – Updated: 2026-09-20 11:09

Title

NivoCart through 2.4.0 Predictable Administrator Password Reset Token

Summary

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/25	issue-tracking
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.4.0 (semver)

Date Public

2026-09-19 00:00

Credits

Ikram-4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator\u0027s email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-338",
              "description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:40.891Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/25"
        },
        {
          "name": "reset token generation at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/forgotten.php#L20-L34"
        },
        {
          "name": "getUserByCode at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/model/user/user.php#L119-L123"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.4.0 Predictable Administrator Password Reset Token",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.4.0-predictable-administrator-password-reset-token"
        }
      ],
      "title": "NivoCart through 2.4.0 Predictable Administrator Password Reset Token",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94107",
    "datePublished": "2026-09-20T11:09:40.891Z",
    "dateReserved": "2026-09-20T10:56:43.733Z",
    "dateUpdated": "2026-09-20T11:09:40.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94105 (GCVE-0-2026-94105)

Vulnerability from nvd – Published: 2026-09-20 11:09 – Updated: 2026-09-20 11:09

Title

NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller

Summary

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/25	issue-tracking
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.4.0 (semver)

Date Public

2026-09-19 00:00

Credits

Ikram-4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:39.569Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/25"
        },
        {
          "name": "reset.php failure branch at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/reset.php#L93-L99"
        },
        {
          "name": "getUserByCode at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/model/user/user.php#L119-L123"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.4.0-destructive-configuration-write-via-the-password-reset-controller"
        }
      ],
      "title": "NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94105",
    "datePublished": "2026-09-20T11:09:39.569Z",
    "dateReserved": "2026-09-20T10:42:42.395Z",
    "dateUpdated": "2026-09-20T11:09:39.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94104 (GCVE-0-2026-94104)

Vulnerability from nvd – Published: 2026-09-20 11:09 – Updated: 2026-09-20 11:09

Title

NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager

Summary

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/25	issue-tracking
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.4.0 (semver)

Date Public

2026-09-19 00:00

Credits

Ikram-4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:38.898Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/25"
        },
        {
          "name": "multi() upload path at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager.php#L527-L562"
        },
        {
          "name": "duplicated file manager controller at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager_full.php"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.4.0-arbitrary-file-upload-rce-via-filemanager"
        }
      ],
      "title": "NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94104",
    "datePublished": "2026-09-20T11:09:38.898Z",
    "dateReserved": "2026-09-20T10:42:42.058Z",
    "dateUpdated": "2026-09-20T11:09:38.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94107 (GCVE-0-2026-94107)

Vulnerability from cvelistv5 – Published: 2026-09-20 11:09 – Updated: 2026-09-20 11:09

Title

NivoCart through 2.4.0 Predictable Administrator Password Reset Token

Summary

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/25	issue-tracking
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.4.0 (semver)

Date Public

2026-09-19 00:00

Credits

Ikram-4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator\u0027s email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-338",
              "description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:40.891Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/25"
        },
        {
          "name": "reset token generation at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/forgotten.php#L20-L34"
        },
        {
          "name": "getUserByCode at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/model/user/user.php#L119-L123"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.4.0 Predictable Administrator Password Reset Token",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.4.0-predictable-administrator-password-reset-token"
        }
      ],
      "title": "NivoCart through 2.4.0 Predictable Administrator Password Reset Token",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94107",
    "datePublished": "2026-09-20T11:09:40.891Z",
    "dateReserved": "2026-09-20T10:56:43.733Z",
    "dateUpdated": "2026-09-20T11:09:40.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94105 (GCVE-0-2026-94105)

Vulnerability from cvelistv5 – Published: 2026-09-20 11:09 – Updated: 2026-09-20 11:09

Title

NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller

Summary

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/25	issue-tracking
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.4.0 (semver)

Date Public

2026-09-19 00:00

Credits

Ikram-4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:39.569Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/25"
        },
        {
          "name": "reset.php failure branch at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/reset.php#L93-L99"
        },
        {
          "name": "getUserByCode at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/model/user/user.php#L119-L123"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.4.0-destructive-configuration-write-via-the-password-reset-controller"
        }
      ],
      "title": "NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94105",
    "datePublished": "2026-09-20T11:09:39.569Z",
    "dateReserved": "2026-09-20T10:42:42.395Z",
    "dateUpdated": "2026-09-20T11:09:39.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94104 (GCVE-0-2026-94104)

Vulnerability from cvelistv5 – Published: 2026-09-20 11:09 – Updated: 2026-09-20 11:09

Title

NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager

Summary

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/nivocart/nivocart/issues/25	issue-tracking
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart/blob/6ea6600…	technical-description
https://github.com/nivocart/nivocart	product
https://www.vulncheck.com/advisories/nivocart-thr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nivocart	nivocart	Affected: 0 , ≤ 2.4.0 (semver)

Date Public

2026-09-19 00:00

Credits

Ikram-4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/nivocart/nivocart",
          "product": "nivocart",
          "repo": "https://github.com/nivocart/nivocart",
          "vendor": "nivocart",
          "versions": [
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:38.898Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #25",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nivocart/nivocart/issues/25"
        },
        {
          "name": "multi() upload path at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager.php#L527-L562"
        },
        {
          "name": "duplicated file manager controller at v2.4.0",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager_full.php"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/nivocart/nivocart"
        },
        {
          "name": "VulnCheck Advisory: NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nivocart-through-2.4.0-arbitrary-file-upload-rce-via-filemanager"
        }
      ],
      "title": "NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94104",
    "datePublished": "2026-09-20T11:09:38.898Z",
    "dateReserved": "2026-09-20T10:42:42.058Z",
    "dateUpdated": "2026-09-20T11:09:38.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

6 vulnerabilities by nivocart

CVE-2026-94107 (GCVE-0-2026-94107)

CVE-2026-94105 (GCVE-0-2026-94105)

CVE-2026-94104 (GCVE-0-2026-94104)

CVE-2026-94107 (GCVE-0-2026-94107)

CVE-2026-94105 (GCVE-0-2026-94105)

CVE-2026-94104 (GCVE-0-2026-94104)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

6 vulnerabilities by nivocart

CVE-2026-94107 (GCVE-0-2026-94107)

CVE-2026-94105 (GCVE-0-2026-94105)

CVE-2026-94104 (GCVE-0-2026-94104)

CVE-2026-94107 (GCVE-0-2026-94107)

CVE-2026-94105 (GCVE-0-2026-94105)

CVE-2026-94104 (GCVE-0-2026-94104)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.