These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-111278 is a CAPTCHA bypass vulnerability in NivoCart through version 2.5.1. The vulnerability allows unauthenticated attackers to defeat form protection by extracting the CAPTCHA answer from the HTML. This could lead to automated spam, registrations, reviews, and account deletion requests. The CVE was published on 2026-10-15T21:43:23.205Z and last modified on 2026-10-16T17:09:17.598Z.
CVE-2026-111277 NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id, potentially disclosing sensitive order data in e-commerce environments. Defenders should assess exposure and prioritize verification and remediation efforts. The vulnerability is caused by a missing authorization check [truncated]
CVE-2026-94107 is a predictable password reset token vulnerability in NivoCart through 2.4.0. The vulnerability generates recovery codes using substr(md5(mt_rand()), 0, 10) in the forgotten.php endpoint. Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.
CVE-2026-94105 is a destructive configuration write vulnerability in NivoCart through 2.4.0. An unauthenticated attacker can disable password recovery by supplying an invalid code parameter to the admin password reset controller. This is achieved by sending a GET request with a missing or incorrect code, rewriting the config_password setting to 0. As a result, self-service password recovery is disabled un [truncated]
CVE-2026-94104 is a high-severity vulnerability in NivoCart, a software that contains an arbitrary file upload vulnerability in its File Manager multi() endpoint. The vulnerability allows attackers with view-only back-office access to upload PHP files to a web-accessible directory, leading to remote code execution. This vulnerability is confirmed in NivoCart version 2.4.0 and earlier. The CVE record and N [truncated]