SY
Vendor
Sylius
35
CVEs
0
On KEV
1
New 30D
Products
SY8.8
Sylius
Sylius
27 CVEs0 on KEV1 new
SY8.8
Syliusresourcebundle
Sylius
3 CVEs0 on KEV0 new
MO7.5
MolliePlugin
Sylius
2 CVEs0 on KEV0 new
GR4.8
Grid
Sylius
1 CVEs0 on KEV0 new
PA7.5
Paypal
Sylius
1 CVEs0 on KEV0 new
SY9.8
Syliusgridbundle
Sylius
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-108724 | SY Sylius Sylius | 5.3 | Oct 11 | Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint |
| CVE-2026-100872 | SY Sylius Sylius | 7.5 | Sep 27 | Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite |
| CVE-2026-100871 | SY Sylius Sylius | 8.8 | Sep 27 | Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication |
| CVE-2026-100870 | SY Sylius Sylius | 8.8 | Sep 27 | Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header |
| CVE-2026-100869 | SY Sylius Sylius | 5.9 | Sep 27 | Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API |
| CVE-2026-53637 | SY Sylius Sylius | 6.5 | Sep 8 | Sylius: Cart FormComponent allows modification or deletion of an already-completed order |
| CVE-2026-53638 | SY Sylius Sylius | 4.3 | Sep 8 | Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint |
| CVE-2026-53639 | SY Sylius Sylius | 6.3 | Sep 8 | Sylius: IDOR on Shop Payment Request API endpoints |
| CVE-2026-68501 | MO MolliePlugin Sylius | 6.5 | Jul 30 | Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII |
| CVE-2026-68500 | MO MolliePlugin Sylius | 7.5 | Jul 30 | Sylius Mollie Plugin: Payment status forgery via the payment webhook |
| CVE-2026-31825 | SY Sylius Sylius | 5.3 | Mar 10 | Sylius has a DQL Injection via API Order Filters |
| CVE-2026-31824 | SY Sylius Sylius | 5.9 | Mar 10 | Sylius has a Promotion Usage Limit Bypass via Race Condition |
| CVE-2026-31823 | SY Sylius Sylius | 4.8 | Mar 10 | Sylius has Authenticated Stored XSS |
| CVE-2026-31822 | SY Sylius Sylius | 6.1 | Mar 10 | Sylius has a XSS vulnerability in checkout login form |
| CVE-2026-31821 | SY Sylius Sylius | 5.3 | Mar 10 | Sylius is Missing Authorization in API v2 Add Item Endpoint |
| CVE-2026-31820 | SY Sylius Sylius | 6.5 | Mar 10 | Sylius affected by IDOR in Cart and Checkout LiveComponents |
| CVE-2026-31819 | SY Sylius Sylius | 6.1 | Mar 10 | Sylius has an Open Redirect via Referer Header |
| CVE-2024-57610 | SY Sylius Sylius | 7.5 | Feb 6 | A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account… |
| CVE-2021-3841 | SY Sylius Sylius | 5.4 | Nov 15 | sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files |
| CVE-2024-29376 | SY Sylius Sylius | 6.4 | Apr 22 | Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book |
| CVE-2022-24752 | SY Syliusgridbundle Sylius | 9.8 | Mar 15 | SyliusGridBundle is a package of generic data grids for Symfony applications |
| CVE-2022-24749 | SY Sylius Sylius | 6.1 | Mar 14 | Sylius is an open source eCommerce platform |
| CVE-2022-24743 | SY Sylius Sylius | 8.2 | Mar 14 | Sylius is an open source eCommerce platform |
| CVE-2022-24742 | SY Sylius Sylius | 5.5 | Mar 14 | Sylius is an open source eCommerce platform |
| CVE-2022-24733 | SY Sylius Sylius | 6.1 | Mar 14 | Sylius is an open source eCommerce platform |
| CVE-2021-41120 | PA Paypal Sylius | 7.5 | Oct 5 | sylius/paypal-plugin is a paypal plugin for the Sylius development platform |
| CVE-2021-32720 | SY Sylius Sylius | 5.3 | Jun 28 | Sylius is an Open Source eCommerce platform on top of Symfony |
| CVE-2020-15245 | SY Sylius Sylius | 4.3 | Oct 19 | In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified… |
| CVE-2020-15146 | SY Syliusresourcebundle Sylius | 8.8 | Aug 20 | In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't… |
| CVE-2020-15143 | SY Syliusresourcebundle Sylius | 8.8 | Aug 20 | In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package… |
| CVE-2020-5220 | SY Syliusresourcebundle Sylius | 5.3 | Jan 27 | Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header |
| CVE-2020-5218 | SY Sylius Sylius | 4.3 | Jan 27 | Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments |
| CVE-2019-12186 | GR Grid Sylius | 4.8 | Dec 31 | An issue was discovered in Sylius products |
| CVE-2019-16768 | SY Sylius Sylius | 4.3 | Dec 5 | In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by… |