Read the docs

Sylius

Records38All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

Sylius records in CISA KEV

No Sylius vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Sylius 19 records HIGH Syliusresourcebundle 3 records MEDIUM Grid 1 record LOW Paypal 1 record LOW Syliusgridbundle 1 record MEDIUM

Records

19 records in Sylius · all components

TI-2022-08557 CVE-2022-24743 · GHSA-mf3v-f2qq-pf9g

Insufficient Session Expiration in Sylius

Priority HIGH 69

Sylius is an open source eCommerce platform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.01252 Published 2022-03-14 Fixed in 1.10.11, 1.11.2 CWE-613
TI-2026-24378 CVE-2026-31825 · GHSA-xcwx-r2gw-w93m

Sylius has a DQL Injection via API Order Filters

Priority MEDIUM 63

Sylius is an Open Source eCommerce Framework on Symfony.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00229 Published 2026-03-10 Fixed in 2.2.3, 2.1.12 +7 CWE-89
TI-2026-24372 CVE-2026-31819 · GHSA-9ffx-f77r-756w

Sylius has an Open Redirect via Referer Header

Priority LOW 36

Sylius is an Open Source eCommerce Framework on Symfony.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00205 Published 2026-03-10 Fixed in 2.2.3, 2.1.12 +7 CWE-601
TI-2021-02772 CVE-2021-3841 · GHSA-hhvr-2q69-4563

Stored Cross-site Scripting (XSS) in sylius/sylius

Priority LOW 24

sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00256 Published 2024-11-15 Fixed in 1.9.10, 1.10.11 +1 CWE-79
TI-2019-09102 CVE-2019-12186 · GHSA-rc5r-697f-28x6

An issue was discovered in Sylius products.

Priority LOW 23

An issue was discovered in Sylius products.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00552 Published 2019-12-31 Fixed in 1.1.19, 1.2.18 +7 CWE-79
TI-2026-24376 CVE-2026-31823 · GHSA-mx4q-xxc9-pf5q

Sylius has Authenticated Stored XSS

Priority LOW 21

Sylius is an Open Source eCommerce Framework on Symfony.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0017 Published 2026-03-10 Fixed in 2.2.3, 2.1.12 +1 CWE-79
TI-2020-12017 CVE-2020-15245 · GHSA-6gw4-x63h-5499

Email verification bypass in Sylius

Priority LOW 21

In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00627 Published 2020-10-19 Fixed in 9.4.4, 1.7.9 +2 CWE-79
TI-2019-12549 CVE-2019-16768 · GHSA-3r8j-pmch-5j2h

Internal exception message exposure for login action in Sylius

Priority LOW 21

In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the sy…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00749 Published 2019-12-05 Fixed in 1.3.14, 1.4.10 +2 CWE-209
Open these records in search →