{"id":"CVE-2026-103524","revision":"a02778e977c742b789dfdc44ca4bed22","records":[{"revision":"a02778e977c742b789dfdc44ca4bed22","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-103524","aliases":[],"title":"CVE-2026-103524","description":"Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation.","state":0,"publishedAt":"2026-10-12T14:54:16.912+00:00","modifiedAt":"2026-10-16T17:16:31.779+00:00","affected":[{"ecosystem":"Vendor product","name":"Thelia","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Thelia\",\n                    \"product\": \"Thelia\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThanOrEqual\": \"2.6.0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://kb.cert.org/vuls/id/162329"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-103524","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-103524","identifiers":["CVE-2026-103524"]},"retained":false,"historicalAffected":[]}],"coverage":[]}