Vendor
NivoCart versions 2.4.0 and earlier are vulnerable to remote code execution via an arbitrary file upload flaw in the File Manager multi() endpoint.