SSylius

Products

Exploited and recent CVEs

• CVE-2026-108724 Medium 5.3 Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint 0.3%
• CVE-2026-100872 High 7.5 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite 0.2%
• CVE-2026-100871 High 8.8 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication 0.3%
• CVE-2026-100870 High 8.8 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header 0.3%
• CVE-2026-100869 Medium 5.9 Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API 0.3%
• CVE-2026-53637 Medium 6.5 Sylius: Cart FormComponent allows modification or deletion of an already-completed order 0.4%
• CVE-2026-53638 Medium 4.3 Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint 0.3%
• CVE-2026-53639 Medium 6.3 Sylius: IDOR on Shop Payment Request API endpoints 0.5%
• CVE-2026-68501 Medium 6.5 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII 0.9%
• CVE-2026-68500 High 7.5 Sylius Mollie Plugin: Payment status forgery via the payment webhook 0.7%
• CVE-2026-31825 Medium 5.3 Sylius has a DQL Injection via API Order Filters 0.2%
• CVE-2026-31824 High 8.2 Sylius has a Promotion Usage Limit Bypass via Race Condition 0.2%
• CVE-2026-31823 Medium 4.8 Sylius has Authenticated Stored XSS 0.2%
• CVE-2026-31822 Medium 5.3 Sylius has a XSS vulnerability in checkout login form 0.2%
• CVE-2026-31821 Medium 6.9 Sylius is Missing Authorization in API v2 Add Item Endpoint 0.2%
• CVE-2026-31820 High 7.1 Sylius affected by IDOR in Cart and Checkout LiveComponents 0.3%
• CVE-2026-31819 Medium 6.9 Sylius has an Open Redirect via Referer Header 0.2%
• CVE-2025-30152 Medium 6.5 Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout 0.4%
• CVE-2025-29788 Medium 6.5 Sylius PayPal Plugin Payment Amount Manipulation Vulnerability 0.5%
• CVE-2021-3841 Medium 4.1 Stored Cross-site Scripting (XSS) in sylius/sylius 0.3%
• CVE-2024-40633 Medium 5.3 Customer data leak via adjustments API endpoint in Sylius 0.4%
• CVE-2024-34349 Medium 4.8 Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel 0.4%
• CVE-2022-24752 Critical 9.8 SQL Injection through sorting parameters in SyliusGridBundle 1.4%
• CVE-2022-24749 Medium 6.1 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius 1.1%
• CVE-2022-24743 High 7.1 Insufficient Session Expiration in Sylius 1.3%
• CVE-2022-24742 Medium 5.0 Exposure of Sensitive Information Due to Incompatible Policies in Sylius 0.8%
• CVE-2022-24733 Medium 6.1 Improper Restriction of Rendered UI Layers or Frames in Sylius 0.9%
• CVE-2021-41120 High 7.5 Unauthorized access to Credit card form in sylius/paypal-plugin 1.5%
• CVE-2021-32720 Medium 5.3 List of order ids, number, items total and token value exposed for unauthorized uses via new API 0.9%
• CVE-2020-15245 Medium 4.3 Email verification bypass in Sylius 0.6%