CVE-2026-103524mediumCWE-79

CVE-2026-103524: falha de média gravidade em Thelia

CVE-2026-103524

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Thelia

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.8epss 0.2%
Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Thelia · Thelia
CVEs relacionadas — Thelia

No mesmo produto, das mais perigosas para as menos.

CVE-2026-103535HIGHCVE-2026-103535EPSS 1.1%CVE-2026-103521HIGHCVE-2026-103521EPSS 0.6%CVE-2026-103522HIGHCVE-2026-103522EPSS 0.6%CVE-2026-103537MEDIUMCVE-2026-103537EPSS 0.6%CVE-2026-103528MEDIUMCVE-2026-103528EPSS 0.5%CVE-2026-107248HIGHCVE-2026-107248EPSS 0.5%