Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-94105— NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller

Quick assessment

Affected
nivocart nivocart
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NivoCart 2.4.0 及更早版本存在一个破坏性配置写入漏洞，位于管理员密码重置控制器中。该漏洞允许未经身份验证的攻击者通过提供无效的 code 参数来禁用密码恢复功能。攻击者可发送一个缺失或 code 参数不正确的 GET 请求，从而将 config_password 配置项重写为 0，导致自助密码恢复功能被禁用，直至管理员手动重新启用该功能。

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-94105

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller
Source: CVE Program / CVE List V5
Vulnerability Description
NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对因果或异常条件的不恰当检查
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nivocart nivocart 0 ~ 2.4.0 -

II. Public POCs for CVE-2026-94105

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-94105

请登录查看更多情报信息。

Other References for CVE-2026-94105 (5)

Same Patch Batch · nivocart · 2026-09-20 · 3 CVEs total

CVE-2026-94104 8.8 HIGH NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
CVE-2026-94107 8.1 HIGH NivoCart through 2.4.0 Predictable Administrator Password Reset Token

IV. Related Vulnerabilities

Same product: nivocart
Same vendor: nivocart
Same weakness: CWE-754

V. Comments for CVE-2026-94105

No comments yet

Leave a comment