CVE-2026-111278
CVE-2026-111278 · NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.
CVSS 6.9 · Moyenne · EPSS 0,3%
- Publication
- Mise à jour
Produits et versions concernés
nivocart
- Versions du logiciel
- ≥ 0, ≤ 2.5.1: Concernée (semver)
Aucun correctif publié
Sources originales
- https://github.com/nivocart/nivocart/issues/27
- https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/information/contact.php#L144-L150
- https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/view/theme/default/template/information/contact.tpl#L43
- https://github.com/nivocart/nivocart
- https://www.vulncheck.com/advisories/nivocart-through-2.5.1-captcha-bypass-via-answer-disclosed-in-page-html
- https://nvd.nist.gov/vuln/detail/CVE-2026-111278