Skip to content
OpenAdvisories

Product · Thelia

Thelia Smarty Module

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.9
    CVE-2026-120206

    Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

    Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprot…

    Thelia Thelia Thelia Core Thelia Back-office Default Twig Template