Vulnerabilities

TI-2026-24378 CVE-2026-31825 · GHSA-xcwx-r2gw-w93m

Sylius has a DQL Injection via API Order Filters

MEDIUM 63

Sylius is an Open Source eCommerce Framework on Symfony.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00229 Published 2026-03-10 Fixed in 2.2.3, 2.1.12 +7 CWE-89

TI-2026-24377 CVE-2026-31824 · GHSA-7mp4-25j8-hp5q

Sylius has a Promotion Usage Limit Bypass via Race Condition

MEDIUM 41

Sylius is an Open Source eCommerce Framework on Symfony.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00206 Published 2026-03-10 Fixed in 2.2.3, 2.1.12 +7 CWE-362

TI-2026-24376 CVE-2026-31823 · GHSA-mx4q-xxc9-pf5q

Sylius has Authenticated Stored XSS

LOW 21

Sylius is an Open Source eCommerce Framework on Symfony.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0017 Published 2026-03-10 Fixed in 2.2.3, 2.1.12 +1 CWE-79

TI-2026-24375 CVE-2026-31822 · GHSA-vgh8-c6fp-7gcg

Sylius has a XSS vulnerability in checkout login form

LOW 29

Sylius is an Open Source eCommerce Framework on Symfony.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00214 Published 2026-03-10 Fixed in 2.2.3, 2.1.12 +1 CWE-79

TI-2026-24374 CVE-2026-31821 · GHSA-wjmg-4cq5-m8hg

Sylius is Missing Authorization in API v2 Add Item Endpoint

HIGH 70

Sylius is an Open Source eCommerce Framework on Symfony.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00211 Published 2026-03-10 Fixed in 2.2.3, 2.1.12 +1 CWE-862

TI-2026-24373 CVE-2026-31820 · GHSA-2xc6-348p-c2x6

Sylius affected by IDOR in Cart and Checkout LiveComponents

LOW 31

Sylius is an Open Source eCommerce Framework on Symfony.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00327 Published 2026-03-10 Fixed in 2.2.3, 2.1.12 +1 CWE-639

TI-2026-24372 CVE-2026-31819 · GHSA-9ffx-f77r-756w

Sylius has an Open Redirect via Referer Header

LOW 36

Sylius is an Open Source eCommerce Framework on Symfony.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00205 Published 2026-03-10 Fixed in 2.2.3, 2.1.12 +7 CWE-601

TI-2024-37963 CVE-2024-57610

A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted…

MEDIUM 41

A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate u…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0122 Published 2025-02-06 No fix listed CWE-307

TI-2021-02772 CVE-2021-3841 · GHSA-hhvr-2q69-4563

Stored Cross-site Scripting (XSS) in sylius/sylius

LOW 24

sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00256 Published 2024-11-15 Fixed in 1.9.10, 1.10.11 +1 CWE-79

TI-2024-19437 CVE-2024-29376 · GHSA-7prj-9ccr-hr3q

Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.

MEDIUM 62

Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00417 Published 2024-04-22 Fixed in 1.9.12, 1.10.16 +3 CWE-79

TI-2022-08563 CVE-2022-24749 · GHSA-4qrp-27r3-66fj

Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius

MEDIUM 60

Sylius is an open source eCommerce platform.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01108 Published 2022-03-14 Fixed in 1.9.10, 1.10.11 +1 CWE-434

TI-2022-08557 CVE-2022-24743 · GHSA-mf3v-f2qq-pf9g

Insufficient Session Expiration in Sylius

HIGH 69

Sylius is an open source eCommerce platform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.01252 Published 2022-03-14 Fixed in 1.10.11, 1.11.2 CWE-613

TI-2022-08556 CVE-2022-24742 · GHSA-7563-75j9-6h5p

Exposure of Sensitive Information Due to Incompatible Policies in Sylius

LOW 26

Sylius is an open source eCommerce platform.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00822 Published 2022-03-14 Fixed in 1.9.10, 1.10.11 +1 CWE-200

TI-2022-08547 CVE-2022-24733 · GHSA-4jp3-q2qm-9fmw

Improper Restriction of Rendered UI Layers or Frames in Sylius

LOW 29

Sylius is an open source eCommerce platform.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00907 Published 2022-03-14 Fixed in 1.9.10, 1.10.11 +1 CWE-1021

TI-2021-12388 CVE-2021-32720 · GHSA-rpxh-vg2x-526v

List of order ids, number, items total and token value exposed for unauthorized uses via new API

LOW 26

Sylius is an Open Source eCommerce platform on top of Symfony.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00881 Published 2021-06-28 Fixed in 1.9.5 CWE-200

TI-2020-12017 CVE-2020-15245 · GHSA-6gw4-x63h-5499

Email verification bypass in Sylius

LOW 21

In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00627 Published 2020-10-19 Fixed in 9.4.4, 1.7.9 +2 CWE-79

TI-2020-04274 CVE-2020-5218 · GHSA-prg5-hg25-8grq

Ability in Sylius to switch channels via GET parameter enabled in production environments

LOW 21

Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments.

CVSS 3.1MEDIUM 4.4 Network Low privileges User interaction EPSS 0.00595 Published 2020-01-27 Fixed in 1.3.13, 1.4.6 +6 CWE-444

TI-2019-09102 CVE-2019-12186 · GHSA-rc5r-697f-28x6

An issue was discovered in Sylius products.

LOW 23

An issue was discovered in Sylius products.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00552 Published 2019-12-31 Fixed in 1.1.19, 1.2.18 +7 CWE-79

TI-2019-12549 CVE-2019-16768 · GHSA-3r8j-pmch-5j2h

Internal exception message exposure for login action in Sylius

LOW 21

In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the sy…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00749 Published 2019-12-05 Fixed in 1.3.14, 1.4.10 +2 CWE-209