CVE-2026-94107 — NivoCart through 2.4.0 Predictable Administrator Password Reset Token
NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10).…
Published: 2026-09-20 · CVSS: 9.2 · CVSS 4.0
NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7