Threats tagged 'ghsa-pfq9-82gg-2grp'

Thelia versions prior to 3.1.0 have a stored cross-site scripting (XSS) vulnerability in the ForSomeCustomers::getSummary() function. This flaw allows unauthenticated attackers to inject malicious scripts via unescaped customer names during registration. When administrators view coupons related to these customers, the injected scripts execute, potentially stealing CSRF tokens and enabling attackers to create administrator accounts.