Approved changes feed: RSS · Atom
cpe:2.3:a:nivocart:nivocart:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Nivocart (025957b7-f3e6-579b-b5a2-c8235b0c8a26) |
|---|---|
| Product | Nivocart (5633f508-4452-5695-8e4d-6ecc83be0a6e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-94104 |
vulnerable | 2026-10-13 12:28:38.939489 |
NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
HIGH (8.8)
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.
Published: 2026-09-20T11:09:38.898Z
Updated: 2026-09-24T11:52:40.897Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-94105 |
vulnerable | 2026-10-13 12:28:38.854283 |
NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller
MEDIUM (5.3)
NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.
Published: 2026-09-20T11:09:39.569Z
Updated: 2026-09-21T14:31:23.863Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-94107 |
vulnerable | 2026-10-13 12:28:38.796810 |
NivoCart through 2.4.0 Predictable Administrator Password Reset Token
HIGH (8.1)
NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.
Published: 2026-09-20T11:09:40.891Z
Updated: 2026-09-21T16:48:09.091Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.