Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 19

Export CSV
CVE-2026-120207

Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia Page Module
CVE-2026-120206

Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia Thelia Back-office Default Template Thelia Back-office Default Twig Template and 1 more
CVE-2026-120248

Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia Thelia Back-office Default Twig Template
CVE-2026-120249

Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes

Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags, zeroing omitted prices.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia Back-office Default Twig Template
CVE-2026-120205

Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-112285

Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-103524

CVE-2026-103524

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-103527

CVE-2026-103527

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-103523

CVE-2026-103523

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `next` parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-107248

CVE-2026-107248

Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-103537

CVE-2026-103537

Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-103529

CVE-2026-103529

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-103528

CVE-2026-103528

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-103535

CVE-2026-103535

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-109397

Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-109396

Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-103521

CVE-2026-103521

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-103522

CVE-2026-103522

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-103526

CVE-2026-103526

In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia