CVE-2026-94105 — NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller
NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password …
Published: 2026-09-20 · CVSS: 6.9 · CVSS 4.0
NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7