https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T06:21:03.747627+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-94104 fkie_cve-2026-94104 2026-09-29T06:21:03.917824+00:00

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.

 https://vulnerability.circl.lu/vuln/ghsa-m76p-p4wh-76x9 GHSA-m76p-p4wh-76x9 2026-09-29T06:21:03.917933+00:00

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.