6 matches found
CVE-2026-120207
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating t...
CVE-2026-120207
The Thelia Page Module version before 2.0.4 is vulnerable to a cross-site request forgery (CSRF) vulnerability. This occurs because back-office delete routes for page tags, documents, and images lack sufficient CSRF tokens and permission checks . A remote attacker can entice a logged-in administr...
EUVD-2026-114728
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating t...
CVE-2026-120207 Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating t...
CVE-2026-120207 Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating t...
CVE-2026-120207: Thelia Thelia Page Module: Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to…
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating t...