Filtered by vendor Thelia
Subscriptions
Filtered by product Thelia Page Module
Subscriptions
Total
1 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-120207 | 1 Thelia | 1 Thelia Page Module | 2026-11-06 | 7.1 High |
| Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories. | ||||
Page 1 of 1.