Threats tagged 'ghsa-xxr4-v6q3-9x28'

Thelia versions before 3.1.1 have a stored cross-site scripting (XSS) vulnerability that allows authenticated back-office administrators with store update permissions to inject malicious scripts by uploading unsanitized SVG images as logo or banner files. This vulnerability enables attackers to execute scripts in the context of visitors and higher-privileged administrators via payloads served from specific directories.