CVE-2026-94105mediumCWE-754

CVE-2026-94105: falha de média gravidade em nivocart

NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar nivocart

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.4%
NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
nivocart · nivocart
CVEs relacionadas — nivocart

No mesmo produto, das mais perigosas para as menos.

CVE-2026-94104HIGHNivoCart through 2.4.0 Arbitrary File Upload RCE via filemanagerEPSS 0.7%CVE-2026-94107CRITICALNivoCart through 2.4.0 Predictable Administrator Password Reset TokenEPSS 0.6%CVE-2026-111277HIGHNivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/downloadEPSS 0.5%CVE-2026-111278MEDIUMNivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTMLEPSS 0.3%