TH
Vendor
Thelia
14
CVEs
0
On KEV
14
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112285 | TH Thelia Thelia | 4.3 | Oct 19 | Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders |
| CVE-2026-109397 | TH Thelia Thelia | 7.2 | Oct 12 | Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space |
| CVE-2026-109396 | TH Thelia Thelia | 4.2 | Oct 12 | Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports |
| CVE-2026-107248 | TH Thelia Thelia | 8.8 | Oct 12 | Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply… |
| CVE-2026-103537 | TH Thelia Thelia | 5.4 | Oct 12 | Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution |
| CVE-2026-103535 | TH Thelia Thelia | 8.8 | Oct 12 | Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution |
| CVE-2026-103529 | TH Thelia Thelia | 5.4 | Oct 12 | Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code |
| CVE-2026-103528 | TH Thelia Thelia | 5.4 | Oct 12 | Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions |
| CVE-2026-103527 | TH Thelia Thelia | 6.1 | Oct 12 | Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting… |
| CVE-2026-103526 | TH Thelia Thelia | 3.7 | Oct 12 | In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated… |
| CVE-2026-103524 | TH Thelia Thelia | 4.8 | Oct 12 | Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface |
| CVE-2026-103523 | TH Thelia Thelia | 6.1 | Oct 12 | Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow |
| CVE-2026-103522 | TH Thelia Thelia | 7.2 | Oct 12 | In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types |
| CVE-2026-103521 | TH Thelia Thelia | 7.2 | Oct 12 | In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation |