Advisories · Technology
Thelia.
Every CVE that names Thelia among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.6 Medium
Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads
- Thelia
- Thelia Core
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
- Thelia
- Thelia Core
- Cross-site request forgery (CSRF)
- CVSS 7.4 High
Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
- Thelia
- Thelia Core
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders
- Thelia
- CWE-837
- CVSS 8.6 High
Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space
- Thelia
- Unrestricted file upload
- CVSS 2.3 Low
Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports
- Thelia
- Other injection
- CVSS 8.8 High
CVE-2026-107248
- Thelia
- Code injection
- CVSS 5.4 Medium
CVE-2026-103537
- Thelia
- Code injection
- CVSS 8.8 High
CVE-2026-103535
- Thelia
- Code injection
- Unrestricted file upload
- CVSS 5.4 Medium
CVE-2026-103529
- Thelia
- Unrestricted file upload
- CVSS 5.4 Medium
CVE-2026-103528
- Thelia
- Code injection
- CVSS 6.1 Medium
CVE-2026-103527
- Thelia
- Cross-site scripting (XSS)
- CVSS 3.7 Low
CVE-2026-103526
- Thelia
- CWE-204
- CVSS 4.8 Medium
CVE-2026-103524
- Thelia
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
CVE-2026-103523
- Thelia
- Open redirect
- CVSS 7.2 High
CVE-2026-103522
- Thelia
- Unrestricted file upload
- CVSS 7.2 High
CVE-2026-103521
- Thelia
- Unrestricted file upload