Priority LOW 36
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item o…
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00323 · Published 2026-10-11 · No fix listed CWE-639
Priority HIGH 77
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00219 · Published 2026-09-27 · Fixed in 2.1.16, 2.2.9 CWE-345
Priority LOW 39
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00309 · Published 2026-09-27 · Fixed in 1.12.25, 1.13.17 +3 CWE-287
Priority LOW 39
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens t…
CVSS 4.0HIGH 8.7· Network · No auth · User interaction · EPSS 0.00311 · Published 2026-09-27 · Fixed in 1.12.25, 1.13.17 +3 CWE-640
Priority LOW 35
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00263 · Published 2026-09-27 · Fixed in 2.1.16, 2.2.9 CWE-863
Priority LOW 29
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00363 · Published 2026-09-08 · Fixed in 2.0.18, 2.1.15 +1 CWE-672
Priority LOW 20
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00284 · Published 2026-09-08 · Fixed in 2.0.18, 2.1.15 +1 CWE-863
Priority LOW 29
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00543 · Published 2026-09-08 · Fixed in 2.0.18, 2.1.15 +1 CWE-639
Priority HIGH 68
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.0087 · Published 2026-07-30 · Fixed in 2.2.8, 3.2.4 +1 CWE-639
Priority MEDIUM 40
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00681 · Published 2026-07-30 · Fixed in 2.2.8, 3.2.4 +1 CWE-639
Priority MEDIUM 63
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00229 · Published 2026-03-10 · Fixed in 2.2.3, 2.1.12 +7 CWE-89
Priority MEDIUM 41
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00206 · Published 2026-03-10 · Fixed in 2.2.3, 2.1.12 +7 CWE-362
Priority LOW 21
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.0017 · Published 2026-03-10 · Fixed in 2.2.3, 2.1.12 +1 CWE-79
Priority LOW 29
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00214 · Published 2026-03-10 · Fixed in 2.2.3, 2.1.12 +1 CWE-79
Priority HIGH 70
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00211 · Published 2026-03-10 · Fixed in 2.2.3, 2.1.12 +1 CWE-862
Priority LOW 31
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00327 · Published 2026-03-10 · Fixed in 2.2.3, 2.1.12 +1 CWE-639
Priority LOW 36
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00205 · Published 2026-03-10 · Fixed in 2.2.3, 2.1.12 +7 CWE-601
Priority LOW 29
The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0035 · Published 2025-03-19 · Fixed in 1.6.2, 1.7.2 +1 CWE-472
Priority LOW 29
The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00502 · Published 2025-03-17 · Fixed in 1.6.1, 1.7.1 +1 CWE-472
Priority MEDIUM 41
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate u…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0122 · Published 2025-02-06 · No fix listed CWE-307
Priority LOW 24
sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00256 · Published 2024-11-15 · Fixed in 1.9.10, 1.10.11 +1 CWE-79
Priority LOW 30
Sylius is an Open Source eCommerce Framework on Symfony.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0038 · Published 2024-07-17 · Fixed in 1.12.19, 1.13.4 +3 CWE-200
Priority LOW 22
Sylius is an open source eCommerce platform.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00436 · Published 2024-05-10 · Fixed in 1.12.16, 1.13.1 +3 CWE-79
Priority MEDIUM 62
Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00417 · Published 2024-04-22 · Fixed in 1.9.12, 1.10.16 +3 CWE-79
Priority MEDIUM 52
SyliusGridBundle is a package of generic data grids for Symfony applications.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01392 · Published 2022-03-15 · Fixed in 1.10.1 CWE-89
Load more
THREATIST.IORead the docs