Sylius vulnerabilities

Products

• Sylius 29
• Paypalplugin 3
• Syliusresourcebundle 3
• Mollieplugin 2

Newest

• sylius Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint CVE-2026-108724 6.9 MediumOctober 11, 2026
• sylius Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite CVE-2026-100872 8.7 HighSeptember 27, 2026
• sylius Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication CVE-2026-100871 8.7 HighSeptember 27, 2026
• sylius Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header CVE-2026-100870 8.7 HighSeptember 27, 2026
• sylius Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API CVE-2026-100869 8.2 HighSeptember 27, 2026
• sylius mollieplugin Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII CVE-2026-68501 Fix available 6.5 MediumJuly 30, 2026
• sylius mollieplugin Sylius Mollie Plugin: Payment status forgery via the payment webhook CVE-2026-68500 Fix available 7.5 HighJuly 30, 2026
• sylius Sylius: IDOR on Shop Payment Request API endpoints CVE-2026-53639 Fix available 6.3 MediumJuly 9, 2026
• sylius Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint CVE-2026-53638 Fix available 4.3 MediumJuly 9, 2026
• sylius Sylius: Cart FormComponent allows modification or deletion of an already-completed order CVE-2026-53637 Fix available 6.5 MediumJuly 9, 2026
• sylius Sylius has a DQL Injection via API Order Filters CVE-2026-31825 Fix available 5.3 MediumMarch 10, 2026
• sylius Sylius has a Promotion Usage Limit Bypass via Race Condition CVE-2026-31824 Fix available 8.2 HighMarch 10, 2026
• sylius Sylius has Authenticated Stored XSS CVE-2026-31823 Fix available 4.8 MediumMarch 10, 2026
• sylius Sylius has a XSS vulnerability in checkout login form CVE-2026-31822 Fix available 5.3 MediumMarch 10, 2026
• sylius Sylius is Missing Authorization in API v2 Add Item Endpoint CVE-2026-31821 Fix available 6.9 MediumMarch 10, 2026
• sylius Sylius affected by IDOR in Cart and Checkout LiveComponents CVE-2026-31820 Fix available 7.1 HighMarch 10, 2026
• sylius Sylius has an Open Redirect via Referer Header CVE-2026-31819 Fix available 6.9 MediumMarch 10, 2026
• sylius paypalplugin Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout CVE-2025-30152 Fix available 6.5 MediumMarch 19, 2025
• sylius paypalplugin Sylius PayPal Plugin Payment Amount Manipulation Vulnerability CVE-2025-29788 Fix available 6.5 MediumMarch 17, 2025
• sylius Withdrawn Advisory: Sylius allows unrestricted brute-force attacks on user accounts CVE-2024-57610 Public exploitDisputed 7.5 HighFebruary 6, 2025
• sylius, sylius sylius/sylius +1 more Stored Cross-site Scripting (XSS) in sylius/sylius CVE-2021-3841 Fix available 4.1 MediumNovember 15, 2024
• sylius Customer data leak via adjustments API endpoint in Sylius CVE-2024-40633 Fix available 5.3 MediumJuly 17, 2024
• sylius Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel CVE-2024-34349 Fix available 4.8 MediumMay 10, 2024
• sylius Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book CVE-2024-29376 Fix available 6.4 MediumApril 22, 2024
• sylius syliusgridbundle SQL Injection through sorting parameters in SyliusGridBundle CVE-2022-24752 Fix available 9.8 CriticalMarch 15, 2022
• sylius Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius CVE-2022-24749 Fix available 6.1 MediumMarch 14, 2022
• sylius Insufficient Session Expiration in Sylius CVE-2022-24743 Fix available 7.1 HighMarch 14, 2022
• sylius Exposure of Sensitive Information Due to Incompatible Policies in Sylius CVE-2022-24742 Fix available 5.0 MediumMarch 14, 2022
• sylius Improper Restriction of Rendered UI Layers or Frames in Sylius CVE-2022-24733 Fix available 6.1 MediumMarch 14, 2022
• sylius paypal, paypalplugin +1 more Unauthorized access to Credit card form in sylius/paypal-plugin CVE-2021-41120 Fix available 7.5 HighOctober 5, 2021
• sylius List of order ids, number, items total and token value exposed for unauthorized uses via new API CVE-2021-32720 Fix available 5.3 MediumJune 28, 2021
• sylius Email verification bypass in Sylius CVE-2020-15245 Fix available 4.3 MediumOctober 19, 2020
• sylius syliusresourcebundle Remote Code Execution in SyliusResourceBundle CVE-2020-15143 Fix available 7.7 HighAugust 19, 2020
• sylius syliusresourcebundle Remote Code Execution in SyliusResourceBundle CVE-2020-15146 Fix available 9.6 CriticalAugust 19, 2020
• sylius Ability in Sylius to switch channels via GET parameter enabled in production environments CVE-2020-5218 Fix available 4.4 MediumJanuary 27, 2020
• sylius syliusresourcebundle Ability to expose data in Sylius by using an unintended serialisation group CVE-2020-5220 Fix available 4.4 MediumJanuary 27, 2020
• sylius grid, sylius +1 more XSS injection in the Grid component of Sylius CVE-2019-12186 Fix available 4.8 MediumDecember 31, 2019
• sylius Internal exception message exposure for login action in Sylius CVE-2019-16768 Fix available 3.5 LowDecember 5, 2019