CVE-2026-94104highCWE-434

CVE-2026-94104: falha de alta gravidade em nivocart

NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar nivocart

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.7%
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
nivocart · nivocart
CVEs relacionadas — nivocart

No mesmo produto, das mais perigosas para as menos.

CVE-2026-94107CRITICALNivoCart through 2.4.0 Predictable Administrator Password Reset TokenEPSS 0.6%CVE-2026-111277HIGHNivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/downloadEPSS 0.5%CVE-2026-94105MEDIUMNivoCart through 2.4.0 Destructive Configuration Write via the Password Reset ControllerEPSS 0.4%CVE-2026-111278MEDIUMNivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTMLEPSS 0.3%