TH
Product
Thelia
14
CVEs
0
On KEV
8.8
Max CVSS
14
New 30D
Severity mix
Critical 0High 5Medium 8Low 1
Watch
Add Thelia to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-103527 | 6.1 | Oct 12 | Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting… Affected: through 2.6.0 |
| CVE-2026-103523 | 6.1 | Oct 12 | Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow Affected: through 2.6.0 |
| CVE-2026-103537 | 5.4 | Oct 12 | Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution Affected: through 2.6.1 |
| CVE-2026-103529 | 5.4 | Oct 12 | Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code Affected: through 2.6.0 |
| CVE-2026-103528 | 5.4 | Oct 12 | Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions Affected: through 2.6.0 |
| CVE-2026-103524 | 4.8 | Oct 12 | Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface Affected: through 2.6.0 |
| CVE-2026-112285 | 4.3 | Oct 19 | Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders Affected: 2.6.2 before 3.1.5; 3.2.0 before 3.2.4 |
| CVE-2026-109396 | 4.2 | Oct 12 | Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports Affected: before 3.1.2; 3.2.0 before 3.2.1 |
Showing 8