Vulnerabilities in Sylius
35 resultsCVE-2025-30152MEDIUMSylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal CheckoutEPSS 0.4%CVE-2026-31820HIGHSylius affected by IDOR in Cart and Checkout LiveComponentsEPSS 0.3%CVE-2026-108724MEDIUMSylius through 2.3.0 Authorization Bypass via Shop API Product-Review EndpointEPSS 0.3%CVE-2026-100870HIGHSylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host HeaderEPSS 0.3%CVE-2026-100871HIGHSylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API AuthenticationEPSS 0.3%CVE-2026-53638MEDIUMSylius: Channel-based payment method restriction bypass on shop account orders API endpointEPSS 0.3%CVE-2026-100869HIGHSylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop APIEPSS 0.3%CVE-2021-3841MEDIUMStored Cross-site Scripting (XSS) in sylius/syliusEPSS 0.3%CVE-2026-31825MEDIUMSylius has a DQL Injection via API Order FiltersEPSS 0.2%CVE-2026-100872HIGHSylius 2.x before 2.1.16 and 2.2.9 Payment Amount OverwriteEPSS 0.2%CVE-2026-31822MEDIUMSylius has a XSS vulnerability in checkout login formEPSS 0.2%CVE-2026-31821MEDIUMSylius is Missing Authorization in API v2 Add Item EndpointEPSS 0.2%CVE-2026-31824HIGHSylius has a Promotion Usage Limit Bypass via Race ConditionEPSS 0.2%CVE-2026-31819MEDIUMSylius has an Open Redirect via Referer HeaderEPSS 0.2%CVE-2026-31823MEDIUMSylius has Authenticated Stored XSSEPSS 0.2%