CVE-2026-111278Medium· 5.3▾ SunlitNivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract t…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.
nivocart <= 2.5.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111277High· 7.5NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download
CVE-2026-94104High· 8.8NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher
CVE-2026-94105Medium· 5.3NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter
CVE-2026-94107High· 8.1NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10)
CVE-2024-23566Medium· 6.5HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented
CVE-2024-23567Medium· 4.3HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage