Skip to content

CVE record · 1 source

CVE-2026-120248

CVSS 4.8

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update…

Vendor: Thelia
Product: Thelia, Thelia Core, Thelia Back-office Default Twig Template
CVSS v3.1: 4.8 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

23

CVE NVD 7h ago

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update…

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file…

CVSS 4.8 CVE-2026-120248 Thelia