Vulnerabilities in Thelia
19 resultsCVE-2026-103535HIGHCVE-2026-103535EPSS 1.1%CVE-2026-103521HIGHCVE-2026-103521EPSS 0.6%CVE-2026-103522HIGHCVE-2026-103522EPSS 0.6%CVE-2026-103537MEDIUMCVE-2026-103537EPSS 0.6%CVE-2026-103528MEDIUMCVE-2026-103528EPSS 0.5%CVE-2026-107248HIGHCVE-2026-107248EPSS 0.5%CVE-2026-109397HIGHThelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing SpaceEPSS 0.4%CVE-2026-103529MEDIUMCVE-2026-103529EPSS 0.3%CVE-2026-112285MEDIUMThelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later OrdersEPSS 0.3%CVE-2026-120205HIGHThelia before 3.1.0 Stored XSS via Coupon Condition Customer NameEPSS 0.3%CVE-2026-103526LOWCVE-2026-103526EPSS 0.3%CVE-2026-103523MEDIUMCVE-2026-103523EPSS 0.3%CVE-2026-120248MEDIUMThelia before 3.1.1 Stored XSS via SVG Store Logo and Banner UploadsEPSS 0.2%CVE-2026-109396LOWThelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via ExportsEPSS 0.2%CVE-2026-103524MEDIUMCVE-2026-103524EPSS 0.2%CVE-2026-120207HIGHThelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete RoutesEPSS 0.2%CVE-2026-103527MEDIUMCVE-2026-103527EPSS 0.2%CVE-2026-120206MEDIUMThelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected ActionsEPSS 0.1%CVE-2026-120249MEDIUMThelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination RoutesEPSS 0.1%