Sylius Sylius
28 CVEs affecting Sylius Sylius. Latest disclosed: 2026-09-27. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-100871 | High | 8.8 | 2026-09-27 | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API… |
CVE-2026-100870 | High | 8.8 | 2026-09-27 | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation… |
CVE-2026-31824 | High | 8.2 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use (TOCTOU) race condition was discovered in the promotion usage limit enf… |
CVE-2026-100872 | High | 7.5 | 2026-09-27 | Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals a… |
CVE-2024-57610 | High | 7.5 | 2025-02-06 | A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk… |
CVE-2022-24743 | High | 7.1 | 2022-03-14 | Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed… |
CVE-2026-53637 | Medium | 6.5 | 2026-09-08 | Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workf… |
CVE-2026-31820 | Medium | 6.5 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. An authenticated Insecure Direct Object Reference (IDOR) vulnerability exists in multiple shop LiveCom… |
CVE-2024-29376 | Medium | 6.4 | 2024-04-22 | Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. |
CVE-2026-31822 | Medium | 6.1 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. A cross-site scripting (XSS) vulnerability exists in the shop checkout login form handled by the ApiLo… |
CVE-2026-31819 | Medium | 6.1 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction() and StorageBa… |
CVE-2022-24749 | Medium | 6.1 | 2022-03-14 | Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scrip… |
CVE-2022-24733 | Medium | 6.1 | 2022-03-14 | Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the web… |
CVE-2026-100869 | Medium | 5.9 | 2026-09-27 | Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed o… |
CVE-2021-3841 | Medium | 5.4 | 2024-11-15 | sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows at… |
CVE-2026-31825 | Medium | 5.3 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. Sylius API filters ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter pass user-supplied… |
CVE-2026-31821 | Medium | 5.3 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An unauthenti… |
CVE-2024-40633 | Medium | 5.3 | 2024-07-17 | Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retriev… |
CVE-2021-32720 | Medium | 5.3 | 2021-06-28 | Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (order ID, order numbe… |
CVE-2022-24742 | Medium | 5.0 | 2022-03-14 | Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed af… |