These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-94107 is a predictable password reset token vulnerability in NivoCart through 2.4.0. The vulnerability generates recovery codes using substr(md5(mt_rand()), 0, 10) in the forgotten.php endpoint. Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.
CVE-2026-94105 is a destructive configuration write vulnerability in NivoCart through 2.4.0. An unauthenticated attacker can disable password recovery by supplying an invalid code parameter to the admin password reset controller. This is achieved by sending a GET request with a missing or incorrect code, rewriting the config_password setting to 0. As a result, self-service password recovery is disabled un [truncated]
CVE-2026-94104 is a high-severity vulnerability in NivoCart, a software that contains an arbitrary file upload vulnerability in its File Manager multi() endpoint. The vulnerability allows attackers with view-only back-office access to upload PHP files to a web-accessible directory, leading to remote code execution. This vulnerability is confirmed in NivoCart version 2.4.0 and earlier. The CVE record and N [truncated]