Cpe:2.3:a:nivocart:nivocart:*:*:*:*:*:*:*:*

NivoCart through 2.5.1 contains a missing authorization vulnerability in the account/order module that allows unauthenticated attackers to exfiltrate guest order invoices by iterating order identifiers.

NivoCart versions 2.4.0 and earlier are vulnerable to remote code execution via an arbitrary file upload flaw in the File Manager multi() endpoint.