back-office_default_template vulnerabilities

CVEs whose affected-version data names the back-office_default_template package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-120206Medium· 5.9PoC

6d ago

Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked token…

▾ TwilightThelia · TheliaEPSS 0.15%via CVEORG