Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Thelia Back-office Default Twig Template 1.1.1 Clear all filters
TI-2026-83574 CVE-2026-120249 · GHSA-j499-8gjf-h2jf

Cross-site request forgery in Thelia back-office product combination routes

Priority MEDIUM 64

Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET request…

CVSS 4.0MEDIUM 6.9 Network No auth User interaction EPSS 0.00144 Published 2026-11-01 Fixed in 1.1.1 CWE-352
TI-2026-83573 CVE-2026-120248 · GHSA-xxr4-v6q3-9x28

Stored cross-site scripting in Thelia via SVG store logo uploads

Priority LOW 21

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banne…

CVSS 4.0MEDIUM 4.6 Network High privileges User interaction EPSS 0.00239 Published 2026-11-01 Fixed in 3.1.1, 1.1.1 CWE-79