Advisories · Technology

nivocart.

Every CVE that names nivocart among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-111278 CVE record

CVSS 6.9 Medium

NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML
- nivocart
- CWE-804
Not analysed yet 15 Oct 2026
CVE-2026-111277 CVE record

CVSS 8.7 High

NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download
- nivocart
- Broken access control
Not analysed yet 15 Oct 2026
CVE-2026-94107 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

NivoCart through 2.4.0 Predictable Administrator Password Reset Token
- nivocart
- Weak cryptography or TLS
Not analysed yet 20 Sept 2026
CVE-2026-94105 CVE record

CVSS 6.9 Medium

NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller
- nivocart
- CWE-754
Not analysed yet 20 Sept 2026
CVE-2026-94104 CVE record

CVSS 8.7 High

NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
- nivocart
- Unrestricted file upload
Not analysed yet 20 Sept 2026