CVE-2026-120205

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...