Skip to content
Multiple Vulnerabilities Found in NivoCart Affecting Admin Access

Multiple Vulnerabilities Found in NivoCart Affecting Admin Access

First seen 20 Sep 2026, 19:55 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 20, 2026 at 21:01 UTC
  • •NivoCart versions up to 2.4.0 are vulnerable to two critical issues.
  • •CVE-2026-94105 allows disabling of password recovery for unauthenticated users.
  • •CVE-2026-94107 enables unauthorized admin access through predictable tokens.

NivoCart versions up to 2.4.0 are affected by two vulnerabilities, CVE-2026-94105 and CVE-2026-94107, both published on 2026-09-20. CVE-2026-94105 is a medium-severity vulnerability allowing unauthenticated attackers to disable password recovery by manipulating the admin password reset controller. CVE-2026-94107 presents a high-risk predictable password reset token vulnerability, enabling attackers to gain unauthorized administrative access by predicting recovery tokens. Both vulnerabilities impact internet-facing shops using NivoCart, particularly those with exposed recovery endpoints. The current status indicates that no active exploitation has been confirmed for CVE-2026-94105, while CVE-2026-94107 has not been confirmed as actively exploited either. Immediate remediation is recommended for both vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-03-26
CVE-2026-33413 published
Strix discovered a critical authentication bypass in etcd, highlighting ongoing vulnerability assessments.
Strix.Ai
2026-09-20
CVE-2026-94105 published
NivoCart vulnerability allows unauthenticated attackers to disable password recovery.
Strix.Ai
2026-09-20
CVE-2026-94107 published
NivoCart vulnerability allows attackers to predict password reset tokens for admin access.
Redpacketsecurity

More articles in this cluster (3)

Following this threat?

Track CVE-2026-33413 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (23)

1 / 4