Exposição de Sylius
Ecommerce12
score de exposição
177
sites usam
0
em exploração
0
críticos
Análise Vexday
Com 17 CVEs catalogadas e nenhuma em exploração ativa no catálogo KEV da CISA, o Sylius apresenta taxa de exploração abaixo da média geral do catálogo, sem registros críticos nem vulnerabilidades novas nos últimos 90 dias. O maior valor EPSS observado é de 0,01232, indicando baixa probabilidade de exploração nas entradas monitoradas. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em validação e sanitização de entradas, especialmente em aplicações voltadas ao público. A CVE mais perigosa ativa no momento, CVE-2022-24743, apresenta EPSS de 0,0123, sugerindo risco contido, mas que deve ser verificado nos ambientes onde o Sylius está em produção.
CVEs
20 resultadosCVE-2022-24743HIGHInsufficient Session Expiration in SyliusEPSS 1.3%CVE-2022-24749MEDIUMBasic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in SyliusEPSS 1.1%CVE-2022-24733MEDIUMImproper Restriction of Rendered UI Layers or Frames in SyliusEPSS 0.9%CVE-2021-32720MEDIUMList of order ids, number, items total and token value exposed for unauthorized uses via new APIEPSS 0.9%CVE-2022-24742MEDIUMExposure of Sensitive Information Due to Incompatible Policies in SyliusEPSS 0.8%CVE-2019-16768LOWInternal exception message exposure for login action in SyliusEPSS 0.7%CVE-2020-15245MEDIUMEmail verification bypass in SyliusEPSS 0.6%CVE-2020-5218MEDIUMAbility in Sylius to switch channels via GET parameter enabled in production environmentsEPSS 0.6%CVE-2026-53639MEDIUMSylius: IDOR on Shop Payment Request API endpointsEPSS 0.5%CVE-2024-34349MEDIUMSylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin PanelEPSS 0.4%CVE-2024-40633MEDIUMCustomer data leak via adjustments API endpoint in SyliusEPSS 0.4%CVE-2026-53637MEDIUMSylius: Cart FormComponent allows modification or deletion of an already-completed orderEPSS 0.3%CVE-2026-31820HIGHSylius affected by IDOR in Cart and Checkout LiveComponentsEPSS 0.3%CVE-2026-31825MEDIUMSylius has a DQL Injection via API Order FiltersEPSS 0.2%CVE-2026-31821MEDIUMSylius is Missing Authorization in API v2 Add Item EndpointEPSS 0.2%CVE-2026-31824HIGHSylius has a Promotion Usage Limit Bypass via Race ConditionEPSS 0.2%CVE-2026-31822MEDIUMSylius has a XSS vulnerability in checkout login formEPSS 0.2%CVE-2026-53638MEDIUMSylius: Channel-based payment method restriction bypass on shop account orders API endpointEPSS 0.2%CVE-2026-31819MEDIUMSylius has an Open Redirect via Referer HeaderEPSS 0.2%CVE-2026-31823MEDIUMSylius has Authenticated Stored XSSEPSS 0.1%