PT-2026-134524
CVE-2026-120205
·
Published
2026-10-31
·
Updated
2026-10-31
Description by
CVSS 3.1
8.0
HighMetricsAV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.
Found an issue in the description? Have something to add? Feel free to write us 👾