CVE-2026-111278
Last modified
CVE-2026-111278 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests..
Description
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-111278?
How severe is CVE-2026-111278?
How do I fix CVE-2026-111278?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-111271libmodplug through 0.8.9.1 contains a heap-based out-of-boun…5.5
- CVE-2026-111272LibRaw through 0.22.2 contains a heap-based out-of-bounds re…5.5
- CVE-2026-111273unarr through 1.1.1 contains an off-by-one heap-based buffer…6.1
- CVE-2026-111274unarr through 1.1.1 contains a heap-based out-of-bounds read…5.5
- CVE-2026-111275nifti_clib through 3.0.1 contains a stack-based out-of-bound…6.1
- CVE-2026-111277NivoCart through 2.5.1 contains a missing authorization vuln…7.5
- CVE-2026-111279Dragonfly through 2.0.2 contains an unbounded memory allocat…7.5
- CVE-2026-11128Inappropriate implementation in Web Share in Google Chrome p…6.5
- CVE-2026-111280snap7 through 1.4.3 contains an out-of-bounds write vulnerab…7.4
- CVE-2026-111281Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02…9.8
- CVE-2026-111282Driftregion iso14229 before 0.10.1 contains an integer wrapa…8.2
- CVE-2026-111283BMC Helix Network Management on-prem before 26.3.01 contains…9
Are you affected by CVE-2026-111278?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST