Dashboard / CVE-2026-120205

CVE-2026-120205

HIGH
MEDIUM Priority: 0.02 BB Relevance: 65/100
Published: 2026-10-31 Modified: 2026-11-02 First seen: 2026-10-31 Status: active

Attack Surface

Network Low Complexity No Auth Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Active
AT: Present
VC: High
VI: High
VA: None

Description

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.

Weakness Classification (1)

Affected Software (6)

VendorProductVersion
Thelia Thelia 0 < 3.1.0
Thelia Thelia 0 < 3.1.0
Thelia Thelia 0 < 3.1.0
Thelia Thelia Core 0 < 3.1.0
Thelia Thelia Core 0 < 3.1.0
Thelia Thelia Core 0 < 3.1.0

References & Advisories (5)

Bug Bounty Relevance

65 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

7.4 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.26%
Raw Score 0.002630
Percentile 18.2%
Date 2026-11-03

EPSS Trend

2026-11-03
0.00263
2026-11-02
0.00263
2026-11-01
0.00263

Intelligence Sources

mitre ref →
nvd ref →

External Links