6 matches found
CVE-2026-109396
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...
CVE-2026-109396 Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...
CVE-2026-109396 Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...
EUVD-2026-97493
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...
CVE-2026-109396
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...
PT-2026-110625
Name of the Vulnerable Software and Affected Versions Thelia versions prior to 3.1.2 Thelia versions 3.2.x prior to 3.2.1 Description An issue exists where unauthenticated visitors can perform CSV formula injection by providing specially crafted data in registration, checkout, or newsletter field...