CVE-2026-94104

HighCVSS 8.8/10Last modified Sep 24, 2026

Description

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Sep 20, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-941055.3NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthent CVE-2026-941068.8getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. CVE-2026-941078.1NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes CVE-2026-941086.5getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disabl CVE-2026-941098.0openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.rende CVE-2026-94116.3A vulnerability was found in SourceCodester Indian Invoicing System 1.0. This issue affects some unknown processing of the file /Invoicing/I CVE-2026-941107.3A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self_Tmp in the library Lib/Config/Controlle CVE-2026-941116.6Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that acce CVE-2026-941126.8mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acc CVE-2026-941136.5Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet end CVE-2026-941145.9Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating th CVE-2026-941158.5Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.