Skip to content
Thelia vulnerabilities
Newest
-
thelia back-office default twig template
Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes
CVE-2026-120249
6.9 Medium
-
thelia, thelia back-office default twig template, core +2 more
Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads
CVE-2026-120248
4.6 Medium
-
thelia page module
Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes
CVE-2026-120207
7.0 High
-
thelia, thelia back-office default template, back-office default twig template +2 more +4 more
Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
CVE-2026-120206
5.9 Medium
-
thelia, thelia core +1 more
Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
CVE-2026-120205
7.4 High
-
thelia
Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders
CVE-2026-112285
5.3 Medium
-
thelia
Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space
CVE-2026-109397
8.6 High
-
thelia
Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports
CVE-2026-109396
2.3 Low
-
thelia
CVE-2026-107248
CVE-2026-107248
8.8 High
-
thelia
CVE-2026-103537
CVE-2026-103537
5.4 Medium
-
thelia
CVE-2026-103535
CVE-2026-103535
8.8 High
-
thelia
CVE-2026-103529
CVE-2026-103529
5.4 Medium
-
thelia
CVE-2026-103528
CVE-2026-103528
5.4 Medium
-
thelia
CVE-2026-103527
CVE-2026-103527
6.1 Medium
-
thelia
CVE-2026-103526
CVE-2026-103526
3.7 Low
-
thelia
CVE-2026-103524
CVE-2026-103524
4.8 Medium
-
thelia
CVE-2026-103523
CVE-2026-103523
6.1 Medium
-
thelia
CVE-2026-103522
CVE-2026-103522
7.2 High
-
thelia
CVE-2026-103521
CVE-2026-103521
7.2 High