https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 22:27:23 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-94107 <p>NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator&#39;s email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.</p> <p>NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator&#39;s email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-94107 https://vulnerability.circl.lu/vuln/ghsa-g4x6-pg76-867r <p>NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator&#39;s email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.</p> <p>NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator&#39;s email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.</p> https://vulnerability.circl.lu/vuln/ghsa-g4x6-pg76-867r