CVE-2026-94107

HIGH 8.1

NivoCart through 2.4.0 Predictable Administrator Password Reset Token

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.

CWE	CWE-338
Vendor	nivocart
Product	nivocart
Published	Sep 20, 2026

Stay Ahead of the Next One

Get instant alerts for nivocart nivocart

Be the first to know when new high vulnerabilities affecting nivocart nivocart are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

nivocart / nivocart

0 ≤ 2.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nivocart/nivocart/issues/25 github.com: https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/forgotten.php#L20-L34 github.com: https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/model/user/user.php#L119-L123 github.com: https://github.com/nivocart/nivocart vulncheck.com: https://www.vulncheck.com/advisories/nivocart-through-2.4.0-predictable-administrator-password-reset-token

Credits

🔍 Ikram-4