Nivocart vulnerabilities
We track 3 vulnerabilities in Nivocart products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.
Latest Nivocart vulnerabilities
- 7.5 High severity
nivocart: Missing Authorization
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which
- 8.1 High severity
nivocart: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset a
- 8.8 High severity
nivocart: Unrestricted Upload of File with Dangerous Type
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload