Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-120206

Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia Thelia Back-office Default Template Thelia Back-office Default Twig Template and 1 more
CVE-2026-120248

Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia Thelia Back-office Default Twig Template
CVE-2026-120249

Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes

Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags, zeroing omitted prices.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia Back-office Default Twig Template