Priority HIGH 77
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00219 · Published 2026-09-27 · Fixed in 2.1.16, 2.2.9 CWE-345
Priority HIGH 70
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00211 · Published 2026-03-10 · Fixed in 2.2.3, 2.1.12 +1 CWE-862
Priority HIGH 69
Sylius is an open source eCommerce platform.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.01252 · Published 2022-03-14 · Fixed in 1.10.11, 1.11.2 CWE-613
Priority HIGH 68
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.0087 · Published 2026-07-30 · Fixed in 2.2.8, 3.2.4 +1 CWE-639
Priority MEDIUM 63
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00229 · Published 2026-03-10 · Fixed in 2.2.3, 2.1.12 +7 CWE-89
Priority MEDIUM 62
Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00417 · Published 2024-04-22 · Fixed in 1.9.12, 1.10.16 +3 CWE-79
Priority MEDIUM 60
Sylius is an open source eCommerce platform.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01108 · Published 2022-03-14 · Fixed in 1.9.10, 1.10.11 +1 CWE-434
Priority MEDIUM 52
SyliusGridBundle is a package of generic data grids for Symfony applications.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01392 · Published 2022-03-15 · Fixed in 1.10.1 CWE-89
Priority MEDIUM 45
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly.
CVSS 3.1CRITICAL 9.6· Network · Low privileges · No interaction · EPSS 0.02149 · Published 2020-08-19 · Fixed in 1.3.14, 1.4.7 +2 CWE-74
Priority MEDIUM 42
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01914 · Published 2020-08-19 · Fixed in 1.3.14, 1.4.7 +2 CWE-74
Priority MEDIUM 41
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00206 · Published 2026-03-10 · Fixed in 2.2.3, 2.1.12 +7 CWE-362
Priority MEDIUM 41
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate u…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0122 · Published 2025-02-06 · No fix listed CWE-307
Priority MEDIUM 40
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00681 · Published 2026-07-30 · Fixed in 2.2.8, 3.2.4 +1 CWE-639
Priority LOW 39
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00309 · Published 2026-09-27 · Fixed in 1.12.25, 1.13.17 +3 CWE-287
Priority LOW 39
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens t…
CVSS 4.0HIGH 8.7· Network · No auth · User interaction · EPSS 0.00311 · Published 2026-09-27 · Fixed in 1.12.25, 1.13.17 +3 CWE-640
Priority LOW 36
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item o…
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00323 · Published 2026-10-11 · No fix listed CWE-639
Priority LOW 36
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00205 · Published 2026-03-10 · Fixed in 2.2.3, 2.1.12 +7 CWE-601
Priority LOW 36
sylius/paypal-plugin is a paypal plugin for the Sylius development platform.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01542 · Published 2021-10-05 · Fixed in 1.2.4, 1.3.1 CWE-200
Priority LOW 35
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00263 · Published 2026-09-27 · Fixed in 2.1.16, 2.2.9 CWE-863
Priority LOW 31
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00327 · Published 2026-03-10 · Fixed in 2.2.3, 2.1.12 +1 CWE-639
Priority LOW 30
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0038 · Published 2024-07-17 · Fixed in 1.12.19, 1.13.4 +3 CWE-200
Priority LOW 29
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00543 · Published 2026-09-08 · Fixed in 2.0.18, 2.1.15 +1 CWE-639
Priority LOW 29
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00363 · Published 2026-09-08 · Fixed in 2.0.18, 2.1.15 +1 CWE-672
Priority LOW 29
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00214 · Published 2026-03-10 · Fixed in 2.2.3, 2.1.12 +1 CWE-79
Priority LOW 29
The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0035 · Published 2025-03-19 · Fixed in 1.6.2, 1.7.2 +1 CWE-472
Load more
THREATIST.IORead the docs