| Package | Affected versions | Patched versions |
|---|---|---|
| No affected product versions are listed for this vulnerability yet. | ||
Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free