Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template injection (SSTI), stored and reflected cross-site scripting (XSS), unauthorized URL redirection, and other risks that expose both server-side and client-side attack surfaces.
VU#162329: Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1
About this summary. This is a short, independently written summary of an article first published by CERT/CC. Cyber Security News did not report or verify the underlying story. Read the original: https://kb.cert.org/vuls/id/162329
Source attribution: headline and facts are from CERT/CC (kb.cert.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities
Ivanti VPN zero-days let attackers gain root access, steal credentials, evade detection, and prepare for wider network compromise. On October 5, Volexity started…
CVE-2026-97229: Critical GitLab RCE
CVE-2026-97229: Critical GitLab RCE GitLab has issued an urgent patch for CVE-2026-97229, a maximum severity integer overflow vulnerability residing in its CI/CD Regular…
CVE-2026-85097: Bricksforge WordPress Plugin Flaw Exploited for Unauthenticated RCE
CVE-2026-85097: Bricksforge WordPress Plugin Flaw Exploited for Unauthenticated RCE Threat actors are actively exploiting CVE-2026-85097, a maximum-severity (CVSS 10.0)…
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical…
Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability
A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000…
Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities
Multiple vulnerabilities in the Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as Next Generation OAM (NGOAM), could allow an…