EUVD-2026-83727

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substrmd5mtrand, 0, 10. Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative...

CVE-2026-94107

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint. Recovery codes are generated using substr(md5(mt_rand()), 0, 10), producing a short and predictable token. An attacker who knows an administrator's email address can request a password ...

CVE-2026-94105

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in its admin password reset controller (reset.php). An unauthenticated attacker can send a GET request with a missing or incorrect code parameter , which rewrites the config_password setting to 0, effectively disablin...

EUVD-2026-83725

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to...

EUVD-2026-83724

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible...

CVE-2026-94104

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint (filemanager.php). The root cause is a failure to validate file extensions for new filenames or when the chunks parameter is 2 or higher. An attacker with view-only back-office access can u...