CVE-2026-120207High· 7.1▾ TwilightThelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. At…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.
page_module < 2.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120206Medium· 5.9Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
CVE-2026-120249Medium· 6.5Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes
CVE-2026-120248Medium· 4.8Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads
CVE-2026-120205High· 8.0Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
CVE-2025-14117Medium· 4.3A vulnerability has been found in fit2cloud Halo 2.21.10
CVE-2026-112285Medium· 4.3Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders