Skip to content
OpenAdvisories

Vendor

nivocart

5 known vulnerabilities.

Products

nivocart 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-111277

    NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download

    NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, whic…

    nivocart nivocart
  • High 8.1
    CVE-2026-94107

    NivoCart through 2.4.0 Predictable Administrator Password Reset Token

    NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset …

    nivocart nivocart
  • High 8.8
    CVE-2026-94104

    NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager

    NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can uploa…

    nivocart nivocart