Sylius vulnerabilities
35 CVEs and advisories name Sylius as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-108724Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint
- CVE-2026-100872Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
- CVE-2026-100871Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
- CVE-2026-100870Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
- CVE-2026-100869Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
- CVE-2026-53637Sylius: Cart FormComponent allows modification or deletion of an already-completed order
- CVE-2026-53638Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
- CVE-2026-53639Sylius: IDOR on Shop Payment Request API endpoints
- CVE-2026-68501Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII
- CVE-2026-68500Sylius Mollie Plugin: Payment status forgery via the payment webhook
- CVE-2026-31825Sylius has a DQL Injection via API Order Filters
- CVE-2026-31824Sylius has a Promotion Usage Limit Bypass via Race Condition
- CVE-2026-31823Sylius has Authenticated Stored XSS
- CVE-2026-31822Sylius has a XSS vulnerability in checkout login form
- CVE-2026-31821Sylius is Missing Authorization in API v2 Add Item Endpoint
- CVE-2026-31820Sylius affected by IDOR in Cart and Checkout LiveComponents
- CVE-2026-31819Sylius has an Open Redirect via Referer Header
- CVE-2025-30152Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout
- CVE-2025-29788Sylius PayPal Plugin Payment Amount Manipulation Vulnerability
- CVE-2021-3841Stored Cross-site Scripting (XSS) in sylius/sylius
- CVE-2024-40633Customer data leak via adjustments API endpoint in Sylius
- CVE-2024-34349Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel
- CVE-2022-24752SQL Injection through sorting parameters in SyliusGridBundle
- CVE-2022-24749Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius
- CVE-2022-24743Insufficient Session Expiration in Sylius
- CVE-2022-24742Exposure of Sensitive Information Due to Incompatible Policies in Sylius
- CVE-2022-24733Improper Restriction of Rendered UI Layers or Frames in Sylius
- CVE-2021-41120Unauthorized access to Credit card form in sylius/paypal-plugin
- CVE-2021-32720List of order ids, number, items total and token value exposed for unauthorized uses via new API
- CVE-2020-15245Email verification bypass in Sylius