Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Oct 19, 2026Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usaCVE-2026-112285 · Other software · Thelia · reported by VulnCheckMedium 5.3
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files byCVE-2026-109397 · Other software · Thelia · reported by VulnCheckHigh 8.6
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas byCVE-2026-109396 · Other software · Thelia · reported by VulnCheckLow 2.3
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” pCVE-2026-107248 · Other software · Thelia · reported by cret@cert.orgHigh 8.8
Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution.CVE-2026-103537 · Other software · Thelia · reported by cret@cert.orgMedium 5.4
Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution.CVE-2026-103535 · Other software · Thelia · reported by cret@cert.orgHigh 8.8
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code.CVE-2026-103529 · Other software · Thelia · reported by cret@cert.orgMedium 5.4
Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions.CVE-2026-103528 · Other software · Thelia · reported by cret@cert.orgMedium 5.4
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑CVE-2026-103527 · Other software · Thelia · reported by cret@cert.orgMedium 6.1
Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowCVE-2026-103526 · Other software · Thelia · reported by cret@cert.orgLow 3.7
In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface.CVE-2026-103524 · Other software · Thelia · reported by cret@cert.orgMedium 4.8
Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow.CVE-2026-103523 · Other software · Thelia · reported by cret@cert.orgMedium 6.1
Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `next` parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types.CVE-2026-103522 · Other software · Thelia · reported by cret@cert.orgHigh 7.2
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same vCVE-2026-103521 · Other software · Thelia · reported by cret@cert.orgHigh 7.2
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2026Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portaCVE-2026-48794 · Other software · authelia · reported by GitHubLow 1.3
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.36.0 through 4.39.19, due to lack of canonicalization of domains in very specific edge cases, an access control rule may be skipped when it should match a request. The specific conditions that could lead to a security issue for vulnerability are: 1. The specific target resource of the attack must be using the forwarded authorization integration; 2. The requested domain must have two additional segments compared to a session domain i.e. `a.b.example.com` is requested, but the session domain is `example.com`; 3. There access control rules must specify two separate rules which both contain inexact domain matches such as `*.b.example.com` and `*.example.com` i.e. wildcards, username matches, group matches; 4. The rules must be in order of most specific domain to least specific domain; 5. The second rule must be more permissive than the first rule; 6. The attacker must specifically request a URL for the more specific domain, with the second part containing one or more capitalized letters i.e. `https://a.B.example
- Product
- authelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2026Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portaCVE-2026-47203 · Other software · authelia · reported by GitHubLow 2.9
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.38.0 through 4.39.19, when a user authenticates via Basic Auth (i.e via the `Authorization` header with the `Basic` scheme) on the authz verification endpoint, Authelia takes the username directly from the `Authorization` header and passes it as is to the regulation system for ban checking and attempt recording. LDAP treats usernames case insensitively : `john`, `John`, and `JOHN` all bind as the same user. But the regulation SQL queries treat the lookup of these values in certain scenarios as case sensitive. This allows each variation of a usernames case to have its own ban bucket. Upgrade to 4.39.20 to receive a patch. As a workaround, explicitly disable the basic auth mechanism.
- Product
- authelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portaCVE-2026-33525 · Other software · authelia · reported by GitHubLow 0.5
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In version 4.39.15, an attacker may potentially be able to inject javascript into the Authelia login page if several conditions are met simultaneously. Unless both the `script-src` and `connect-src` directives have been modified it's almost impossible for this to have a meaningful impact. However if both of these are and they are done so without consideration to their potential impact; there is a are situations where this vulnerability could be exploited. This is caused to the lack of neutralization of the `langauge` cookie value when rendering the HTML template. This vulnerability is likely difficult to discover though fingerprinting due to the way Authelia is designed but it should not be considered impossible. The additional requirement to identify the secondary application is however likely to be significantly harder to identify along side this, but also likely easier to fingerprint. Users should upgrade to 4.39.16 or downgrade to 4.39.14 to mitigate the issue. The overwhelming majority of installations will not be af
- Product
- authelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2025A weakness has been identified in codingWithElias School Management System up to f1ac334bfd89ae9067cc14dea12ec6ff3f078c01.CVE-2025-13795 · Other software · codingWithElias · reported by VulDBLow 1.9
A weakness has been identified in codingWithElias School Management System up to f1ac334bfd89ae9067cc14dea12ec6ff3f078c01. Affected is an unknown function of the file /student-view.php of the component Edit Student Info Page. This manipulation of the argument First Name causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- School Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portaCVE-2025-24806 · Other software · authelia · reported by GitHubLow 2.3
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. If users are allowed to sign in via both username and email the regulation system treats these as separate login events. This leads to the regulation limitations being effectively doubled assuming an attacker using brute-force to find a user password. It's important to note that due to the effective operation of regulation where no user-facing sign of their regulation ban being visible either via timing or via API responses, it's effectively impossible to determine if a failure occurs due to a bad username password combination, or a effective ban blocking the attempt which heavily mitigates any form of brute-force. This occurs because the records and counting process for this system uses the method utilized for sign in rather than the effective username attribute. This has a minimal impact on account security, this impact is increased naturally in scenarios when there is no two-factor authentication required and weak passwords are used. This makes it a bit easier to brute-force a password. A patch for this issue has been
- Product
- authelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to anotherCVE-2023-6545 · Other software · Beckhoff · reported by info@cert.vde.comMedium 4.7
The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to another site. This may have limited impact to integrity and does solely affect anthelia-bhf the Beckhoff fork of authelia.
- Product
- authelia-bhf of TwinCAT/BSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comdownload.beckhoff.com
May 28, 2021Authelia is a a single sign-on multi-factor portal for web apps.CVE-2021-32637 · Other software · authelia · reported by GitHubCritical 10
Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect other proxy servers, but all of the ones we officially support except nginx do not allow malformed URI paths. The problem is rectified entirely in v4.29.3. As this patch is relatively straightforward we can back port this to any version upon request. Alternatively we are supplying a git patch to 4.25.1 which should be relatively straightforward to apply to any version, the git patches for specific versions can be found in the references. The most relevant workaround is upgrading. You can also add a block which fails requests that contains a malformed URI in the internal location block.
- Product
- authelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2021Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on (SSO) for your applications via a web poCVE-2021-29456 · Other software · authelia · reported by GitHubMedium 5.7
Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on (SSO) for your applications via a web portal. In versions 4.27.4 and earlier, utilizing a HTTP query parameter an attacker is able to redirect users from the web application to any domain, including potentially malicious sites. This security issue does not directly impact the security of the web application itself. As a workaround, one can use a reverse proxy to strip the query parameter from the affected endpoint. There is a patch for version 4.28.0.
- Product
- authelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.