6 matches found
EUVD-2026-102531
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an orderid. Attackers can iterate the orderid parameter, which matches guest orders stored with...
CVE-2026-111277
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an orderid. Attackers can iterate the orderid parameter, which matches guest orders stored with...
CVE-2026-111277 NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an orderid. Attackers can iterate the orderid parameter, which matches guest orders stored with...
CVE-2026-111277
NivoCart versions through 2.5.1 are vulnerable to a missing authorization vulnerability in the download() action of the account/order component. Unauthenticated attackers can exploit this by supplying a specific order_id to retrieve guest order invoices. By iterating the order_id parameter, attac...
CVE-2026-111277 NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an orderid. Attackers can iterate the orderid parameter, which matches guest orders stored with...
CVE-2026-111277 NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an orderid. Attackers can iterate the orderid parameter, which matches guest orders stored with...