Filtered by vendor Thelia
Subscriptions
Filtered by product Thelia Smarty Module
Subscriptions
Total
1 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-120206 | 1 Thelia | 4 Thelia, Thelia Back-office Default Template, Thelia Back-office Default Twig Template and 1 more | 2026-11-05 | 5.9 Medium |
| Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects. | ||||
Page 1 of 1.