SY
Product
Sylius
27
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 5Medium 22Low 0
Watch
Add Sylius to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-100871 | 8.8 | Sep 27 | Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication Affected: 1.11.0 before 1.12.25; 1.13.0 before 1.13.17; 1.14.0 before 1.14.20; 2.0.0 before 2.1.16; 2.2.0 before 2.2.9 |
| CVE-2026-100870 | 8.8 | Sep 27 | Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header Affected: 1.12.0 before 1.12.25; 1.13.0 before 1.13.17; 1.14.0 before 1.14.20; 2.0.0 before 2.1.16; 2.2.0 before 2.2.9 |
| CVE-2022-24743 | 8.2 | Mar 14 | Sylius is an open source eCommerce platform Affected: 1.10.0 before 1.10.11; 1.11.0 before 1.11.2 |
| CVE-2026-100872 | 7.5 | Sep 27 | Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite Affected: 2.0.0 before 2.1.16; 2.2.0 before 2.2.9 |
| CVE-2024-57610 | 7.5 | Feb 6 | A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account… Affected: 2.0.2 |
| CVE-2026-53637 | 6.5 | Sep 8 | Sylius: Cart FormComponent allows modification or deletion of an already-completed order Affected: >= 2.0.0, < 2.0.18; >= 2.1.0, < 2.1.15; >= 2.2.0, < 2.2.6 |
| CVE-2026-31820 | 6.5 | Mar 10 | Sylius affected by IDOR in Cart and Checkout LiveComponents Affected: >= 2.2.0, < 2.2.3; >= 2.1.0, < 2.1.12; >= 2.0.0, < 2.0.16 |
| CVE-2024-29376 | 6.4 | Apr 22 | Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book Affected: 1.12.13 |
| CVE-2026-53639 | 6.3 | Sep 8 | Sylius: IDOR on Shop Payment Request API endpoints Affected: >= 2.0.0, < 2.0.18; >= 2.1.0, < 2.1.15; >= 2.2.0, < 2.2.6 |
| CVE-2026-31822 | 6.1 | Mar 10 | Sylius has a XSS vulnerability in checkout login form Affected: >= 2.2.0, < 2.2.3; >= 2.1.0, < 2.1.12; >= 2.0.0, < 2.0.16 |
| CVE-2026-31819 | 6.1 | Mar 10 | Sylius has an Open Redirect via Referer Header Affected: >= 2.2.0, < 2.2.3; >= 2.1.0, < 2.1.12; >= 2.0.0, < 2.0.16; >= 1.14.0, < 1.14.18; >= 1.13.0, < 1.13.15; >= 1.12.0, < 1.12.23; +3 more |
| CVE-2022-24749 | 6.1 | Mar 14 | Sylius is an open source eCommerce platform Affected: before 1.9.10; 1.10.0 before 1.10.11; 1.11.0 before 1.11.2 |
| CVE-2022-24733 | 6.1 | Mar 14 | Sylius is an open source eCommerce platform Affected: before 1.9.10; 1.10.0 before 1.10.11; 1.11.0 before 1.11.2 |
| CVE-2026-100869 | 5.9 | Sep 27 | Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API Affected: 2.0.0 before 2.1.16; 2.2.0 before 2.2.9 |
| CVE-2026-31824 | 5.9 | Mar 10 | Sylius has a Promotion Usage Limit Bypass via Race Condition Affected: >= 2.2.0, < 2.2.3; >= 2.1.0, < 2.1.12; >= 2.0.0, < 2.0.16; >= 1.14.0, < 1.14.18; >= 1.13.0, < 1.13.15; >= 1.12.0, < 1.12.23; +3 more |
| CVE-2022-24742 | 5.5 | Mar 14 | Sylius is an open source eCommerce platform Affected: before 1.9.10; 1.10.0 before 1.10.11; 1.11.0 before 1.11.2 |
| CVE-2021-3841 | 5.4 | Nov 15 | sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files Affected: before 1.9.10; 1.10.0 before 1.10.11; 1.11.0 before 1.11.2 |
| CVE-2026-108724 | 5.3 | Oct 11 | Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint Affected: through 2.3.0 |
| CVE-2026-31825 | 5.3 | Mar 10 | Sylius has a DQL Injection via API Order Filters Affected: >= 2.2.0, < 2.2.3; >= 2.1.0, < 2.1.12; >= 2.0.0, < 2.0.16; >= 1.14.0, < 1.14.18; >= 1.13.0, < 1.13.15; >= 1.12.0, < 1.12.23; +3 more |
| CVE-2026-31821 | 5.3 | Mar 10 | Sylius is Missing Authorization in API v2 Add Item Endpoint Affected: >= 2.2.0, < 2.2.3; >= 2.1.0, < 2.1.12; >= 2.0.0, < 2.0.16 |
| CVE-2021-32720 | 5.3 | Jun 28 | Sylius is an Open Source eCommerce platform on top of Symfony Affected: 1.9.0 before 1.9.5 |
| CVE-2026-31823 | 4.8 | Mar 10 | Sylius has Authenticated Stored XSS Affected: >= 2.2.0, < 2.2.3; >= 2.1.0, < 2.1.12; >= 2.0.0, < 2.0.16 |
| CVE-2019-12186 | 4.8 | Dec 31 | An issue was discovered in Sylius products Affected: 1.0.0 through 1.0.18; 1.1.0 through 1.1.17; 1.2.0 through 1.2.16; 1.3.0 through 1.3.11; 1.4.0 through 1.4.3 |
| CVE-2026-53638 | 4.3 | Sep 8 | Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint Affected: >= 2.0.0, < 2.0.18; >= 2.1.0, < 2.1.15; >= 2.2.0, < 2.2.6 |
| CVE-2020-15245 | 4.3 | Oct 19 | In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified… Affected: before 1.6.9; 1.7.0 before 1.7.9; 1.8.0 before 1.8.3 |
| CVE-2020-5218 | 4.3 | Jan 27 | Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments Affected: 1.3.0 before 1.3.13; 1.4.0 before 1.4.6; 1.6.0 before 1.6.3; 1.5.0 |
| CVE-2019-16768 | 4.3 | Dec 5 | In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by… Affected: before 1.3.14; 1.4.0 before 1.4.10; 1.5.0 before 1.5.7; 1.6.0 before 1.6.3 |
Showing 27