# cve.now: Sylius

The newest entries naming Sylius as an affected vendor (up to 200), of 35 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-108724](https://cve.now/CVE-2026-108724.md): Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint (CVSS 6.9)
- [CVE-2026-100872](https://cve.now/CVE-2026-100872.md): Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite (CVSS 8.7)
- [CVE-2026-100871](https://cve.now/CVE-2026-100871.md): Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication (CVSS 8.7)
- [CVE-2026-100870](https://cve.now/CVE-2026-100870.md): Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header (CVSS 8.7)
- [CVE-2026-100869](https://cve.now/CVE-2026-100869.md): Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API (CVSS 8.2)
- [CVE-2026-53637](https://cve.now/CVE-2026-53637.md): Sylius: Cart FormComponent allows modification or deletion of an already-completed order (CVSS 6.5)
- [CVE-2026-53638](https://cve.now/CVE-2026-53638.md): Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint (CVSS 4.3)
- [CVE-2026-53639](https://cve.now/CVE-2026-53639.md): Sylius: IDOR on Shop Payment Request API endpoints (CVSS 6.3)
- [CVE-2026-68501](https://cve.now/CVE-2026-68501.md): Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII (CVSS 6.5)
- [CVE-2026-68500](https://cve.now/CVE-2026-68500.md): Sylius Mollie Plugin: Payment status forgery via the payment webhook (CVSS 7.5)
- [CVE-2026-31825](https://cve.now/CVE-2026-31825.md): Sylius has a DQL Injection via API Order Filters (CVSS 5.3)
- [CVE-2026-31824](https://cve.now/CVE-2026-31824.md): Sylius has a Promotion Usage Limit Bypass via Race Condition (CVSS 8.2)
- [CVE-2026-31823](https://cve.now/CVE-2026-31823.md): Sylius has Authenticated Stored XSS (CVSS 4.8)
- [CVE-2026-31822](https://cve.now/CVE-2026-31822.md): Sylius has a XSS vulnerability in checkout login form (CVSS 5.3)
- [CVE-2026-31821](https://cve.now/CVE-2026-31821.md): Sylius is Missing Authorization in API v2 Add Item Endpoint (CVSS 6.9)
- [CVE-2026-31820](https://cve.now/CVE-2026-31820.md): Sylius affected by IDOR in Cart and Checkout LiveComponents (CVSS 7.1)
- [CVE-2026-31819](https://cve.now/CVE-2026-31819.md): Sylius has an Open Redirect via Referer Header (CVSS 6.9)
- [CVE-2025-30152](https://cve.now/CVE-2025-30152.md): Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout (CVSS 6.5)
- [CVE-2025-29788](https://cve.now/CVE-2025-29788.md): Sylius PayPal Plugin Payment Amount Manipulation Vulnerability (CVSS 6.5)
- [CVE-2021-3841](https://cve.now/CVE-2021-3841.md): Stored Cross-site Scripting (XSS) in sylius/sylius (CVSS 4.1)
- [CVE-2024-40633](https://cve.now/CVE-2024-40633.md): Customer data leak via adjustments API endpoint in Sylius (CVSS 5.3)
- [CVE-2024-34349](https://cve.now/CVE-2024-34349.md): Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel (CVSS 4.8)
- [CVE-2022-24752](https://cve.now/CVE-2022-24752.md): SQL Injection through sorting parameters in SyliusGridBundle (CVSS 9.8)
- [CVE-2022-24749](https://cve.now/CVE-2022-24749.md): Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius (CVSS 6.1)
- [CVE-2022-24743](https://cve.now/CVE-2022-24743.md): Insufficient Session Expiration in Sylius (CVSS 7.1)
- [CVE-2022-24742](https://cve.now/CVE-2022-24742.md): Exposure of Sensitive Information Due to Incompatible Policies in Sylius (CVSS 5.0)
- [CVE-2022-24733](https://cve.now/CVE-2022-24733.md): Improper Restriction of Rendered UI Layers or Frames in Sylius (CVSS 6.1)
- [CVE-2021-41120](https://cve.now/CVE-2021-41120.md): Unauthorized access to Credit card form in sylius/paypal-plugin (CVSS 7.5)
- [CVE-2021-32720](https://cve.now/CVE-2021-32720.md): List of order ids, number, items total and token value exposed for unauthorized uses via new API (CVSS 5.3)
- [CVE-2020-15245](https://cve.now/CVE-2020-15245.md): Email verification bypass in Sylius (CVSS 4.3)
- [CVE-2020-15143](https://cve.now/CVE-2020-15143.md): Remote Code Execution in SyliusResourceBundle (CVSS 7.7)
- [CVE-2020-15146](https://cve.now/CVE-2020-15146.md): Remote Code Execution in SyliusResourceBundle (CVSS 9.6)
- [CVE-2020-5218](https://cve.now/CVE-2020-5218.md): Ability in Sylius to switch channels via GET parameter enabled in production environments (CVSS 4.4)
- [CVE-2020-5220](https://cve.now/CVE-2020-5220.md): Ability to expose data in Sylius by using an unintended serialisation group (CVSS 4.4)
- [CVE-2019-16768](https://cve.now/CVE-2019-16768.md): Internal exception message exposure for login action in Sylius (CVSS 3.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/sylius
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.