[ Vendor · 14 CVEs ]
Thelia
CVEs affecting Thelia published in the last 30 days, plus any Thelia CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-112285 | 19 Oct 2026 | CVSS 4.3 | TheliaThelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits… | |
| CVE-2026-109396 | 12 Oct 2026 | CVSS 4.2 | TheliaThelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet… | |
| CVE-2026-109397 | 12 Oct 2026 | CVSS 7.2 | TheliaThelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload… | |
| CVE-2026-107248 | 12 Oct 2026 | CVSS 8.8 | TheliaThelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the… | |
| CVE-2026-103526 | 12 Oct 2026 | CVSS 3.7 | TheliaIn Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect… | |
| CVE-2026-103527 | 12 Oct 2026 | CVSS 6.1 | TheliaThelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling… | |
| CVE-2026-103528 | 12 Oct 2026 | CVSS 5.4 | TheliaThelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can… | |
| CVE-2026-103529 | 12 Oct 2026 | CVSS 5.4 | TheliaThelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing… | |
| CVE-2026-103535 | 12 Oct 2026 | CVSS 8.8 | TheliaThelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code… | |
| CVE-2026-103537 | 12 Oct 2026 | CVSS 5.4 | TheliaThelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The… | |
| CVE-2026-103521 | 12 Oct 2026 | CVSS 7.2 | TheliaIn Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform… | |
| CVE-2026-103522 | 12 Oct 2026 | CVSS 7.2 | TheliaIn Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An… | |
| CVE-2026-103523 | 12 Oct 2026 | CVSS 6.1 | TheliaThelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits… | |
| CVE-2026-103524 | 12 Oct 2026 | CVSS 4.8 | TheliaThelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without… |