CVEs we hold for Sylius

Records whose assigning authority named Sylius as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-68501Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PIISylius MolliePlugin

CVE-2026-68500Sylius Mollie Plugin: Payment status forgery via the payment webhookSylius MolliePlugin

CVE-2026-53639Sylius: IDOR on Shop Payment Request API endpointsSylius

CVE-2026-53638Sylius: Channel-based payment method restriction bypass on shop account orders API endpointSylius

CVE-2026-53637Sylius: Cart FormComponent allows modification or deletion of an already-completed orderSylius

CVE-2026-31825Sylius has a DQL Injection via API Order FiltersSylius

CVE-2026-31824Sylius has a Promotion Usage Limit Bypass via Race ConditionSylius

CVE-2026-31823Sylius has Authenticated Stored XSSSylius

CVE-2026-31822Sylius has a XSS vulnerability in checkout login formSylius

CVE-2026-31821Sylius is Missing Authorization in API v2 Add Item EndpointSylius

CVE-2026-31820Sylius affected by IDOR in Cart and Checkout LiveComponentsSylius

CVE-2026-31819Sylius has an Open Redirect via Referer HeaderSylius

CVE-2025-30152Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal CheckoutSylius PayPalPlugin

CVE-2025-29788Sylius PayPal Plugin Payment Amount Manipulation VulnerabilitySylius PayPalPlugin

CVE-2024-40633Customer data leak via adjustments API endpoint in SyliusSylius

CVE-2024-34349Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin…Sylius

CVE-2022-24752SQL Injection through sorting parameters in SyliusGridBundleSylius SyliusGridBundle

CVE-2022-24749Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in SyliusSylius

CVE-2022-24743Insufficient Session Expiration in SyliusSylius

CVE-2022-24742Exposure of Sensitive Information Due to Incompatible Policies in SyliusSylius

CVE-2022-24733Improper Restriction of Rendered UI Layers or Frames in SyliusSylius

CVE-2021-41120Unauthorized access to Credit card form in sylius/paypal-pluginSylius PayPalPlugin

CVE-2021-3841Stored Cross-site Scripting (XSS) in sylius/syliussylius/sylius

CVE-2021-32720List of order ids, number, items total and token value exposed for unauthorized uses via new APISylius

CVE-2020-5220Ability to expose data in Sylius by using an unintended serialisation groupSylius SyliusResourceBundle

CVE-2020-5218Ability in Sylius to switch channels via GET parameter enabled in production environmentsSylius

CVE-2020-15245Email verification bypass in SyliusSylius

CVE-2020-15146Remote Code Execution in SyliusResourceBundleSylius SyliusResourceBundle

CVE-2020-15143Remote Code Execution in SyliusResourceBundleSylius SyliusResourceBundle

CVE-2019-16768Internal exception message exposure for login action in SyliusSylius

30 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.