NivoCart EUVD-2026-83725

No special conditions - remote unauthenticated exploitation against default configurations of NivoCart through 2.4.0, requiring only a single GET request to the admin password-reset controller (reset.php) with an absent or incorrect 'code' parameter. The only meaningful limit is that the admin reset endpoint must be network-reachable. Impact is bounded and self-recoverable: the sole effect is setting config_password to 0, which disables self-service password recovery until an administrator manually re-enables it - no authentication bypass, data access, or code execution results.

This is a low-priority, high-visibility-but-low-impact issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N, 6.9) correctly captures a network, low-complexity, unauthenticated flaw with ONLY a low integrity impact and no confidentiality or availability impact - the 6.9 base is inflated primarily by the unauthenticated network reach rather than by consequence. My independent CVSS 3.1 assessment is ~5.3 (I:L only). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or imminent exploitation. Critically, the actual damage is trivial and self-healing: an attacker sets config_password to 0, disabling self-service password recovery until an admin re-enables it - no data is read, no code runs, no persistent compromise occurs. The 'Information Disclosure' tag conflicts with the mechanism, which is a configuration WRITE (integrity/functional degradation), not a read/disclosure; treat that tag as inaccurate. Net: a real but minor nuisance-grade integrity bug, not an operational priority.

An unauthenticated attacker sends a single GET request to the admin password-reset controller (reset.php) with a missing or incorrect 'code' parameter, which the flawed CWE-754 error handling routes into a config write that sets config_password to 0. This disables the self-service password-recovery feature for legitimate admins until one manually re-enables it. No public exploit code is identified at time of analysis, though the trivial single-request nature makes reproduction straightforward.