Vendor

    Thelia

    19 known vulnerabilities in products by Thelia, 0 of them actively exploited (CISA KEV).

    Key figures

    19

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    0

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Thelia
    HighCVE-2026-103535

    Thelia: Code Injection

    		8.8
    HighCVE-2026-107248

    Thelia: Template Injection

    		8.8
    HighCVE-2026-103521

    Thelia: Remote Code Execution

    		7.2
    HighCVE-2026-109397

    Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space

    		7.2
    HighCVE-2026-103522

    Thelia: Remote Code Execution

    		7.2
    MediumCVE-2026-103537

    Thelia: Path Traversal

    		5.4
    HighCVE-2026-120205

    Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

    		8.0
    MediumCVE-2026-103528

    Thelia: Remote Code Execution

    		5.4
    HighCVE-2026-120207

    Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

    		7.1
    MediumCVE-2026-120249

    Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes

    		6.5
    MediumCVE-2026-103523

    Thelia: Open Redirect

    		6.1
    MediumCVE-2026-103527

    Thelia: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2026-103529

    Thelia: Remote Code Execution

    		5.4
    MediumCVE-2026-112285

    Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders

    		4.3
    MediumCVE-2026-120206

    Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

    		5.9
    MediumCVE-2026-120248

    Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads

    		4.8
    MediumCVE-2026-103524

    Thelia: Cross-Site Scripting (XSS)

    		4.8
    MediumCVE-2026-109396

    Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

    		4.2
    LowCVE-2026-103526

    Thelia: security vulnerability

    		3.7

    Products

    Products by Thelia
    Thelia170
    Thelia Back-office Default Twig Template30
    Thelia Core30