{"id":"CVE-2026-103527","revision":"8a138762462c4914b4ae8cbbbb7af5b5","records":[{"revision":"8a138762462c4914b4ae8cbbbb7af5b5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-103527","aliases":[],"title":"CVE-2026-103527","description":"Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.","state":0,"publishedAt":"2026-10-12T14:54:53.807+00:00","modifiedAt":"2026-10-16T17:24:55.616+00:00","affected":[{"ecosystem":"Vendor product","name":"Thelia","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Thelia\",\n                    \"product\": \"Thelia\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThanOrEqual\": \"2.6.0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://kb.cert.org/vuls/id/162329"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-103527","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-103527","identifiers":["CVE-2026-103527"]},"retained":false,"historicalAffected":[]}],"coverage":[]}