Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Sylius — Vulnerabilities & Security Advisories 25

All 25 CVE vulnerabilities found in Sylius, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities for Sylius, a PHP-based e-commerce framework. The collection focuses on open-source project-specific flaws, covering advisories published within the recent historical timeframe. The page indexes vulnerabilities related to Sylius, including issues involving cross-site scripting, SQL injection, and dependency weaknesses in its ecosystem. The data spans the period from the earliest available CVE record to the most recently published advisory. Readers can use this page to track the vendor's security advisories, understand common weakness classes affecting Sylius, and review the product's vulnerability history. This resource supports security analysis by providing a centralized view of disclosed issues, enabling users to monitor patch releases and assess the risk posture of systems utilizing the framework.

Vendor: Sylius

CVE ID Title CVSS Severity Published
CVE-2026-108724 Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint CWE-639 5.3 Medium 2026-10-11
CVE-2026-100872 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite CWE-345 7.5 High 2026-09-27
CVE-2026-100870 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header CWE-640 8.8 High 2026-09-27
CVE-2026-100871 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication CWE-287 8.8 High 2026-09-27
CVE-2026-100869 Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API CWE-863 5.9 Medium 2026-09-27
CVE-2026-53637 Sylius: Cart FormComponent allows modification or deletion of an already-completed order CWE-672 6.5 Medium 2026-09-08
CVE-2026-53638 Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint CWE-863 4.3 Medium 2026-09-08
CVE-2026-53639 Sylius: IDOR on Shop Payment Request API endpoints CWE-639 6.3 Medium 2026-09-08
CVE-2026-31825 Sylius has a DQL Injection via API Order Filters CWE-89 5.3 Medium 2026-03-10
CVE-2026-31824 Sylius has a Promotion Usage Limit Bypass via Race Condition CWE-362 8.2 High 2026-03-10
CVE-2026-31823 Sylius has Authenticated Stored XSS CWE-79 4.8 Medium 2026-03-10
CVE-2026-31822 Sylius has a XSS vulnerability in checkout login form CWE-79 6.1AI Medium AI 2026-03-10
CVE-2026-31821 Sylius is Missing Authorization in API v2 Add Item Endpoint CWE-862 5.3AI Medium AI 2026-03-10
CVE-2026-31820 Sylius affected by IDOR in Cart and Checkout LiveComponents CWE-639 8.1AI High AI 2026-03-10
CVE-2026-31819 Sylius has an Open Redirect via Referer Header CWE-601 6.1AI Medium AI 2026-03-10
CVE-2024-40633 Customer data leak via adjustments API endpoint in Sylius CWE-200 5.3 Medium 2024-07-17
CVE-2024-34349 Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel CWE-79 4.8 Medium 2024-05-10
CVE-2022-24749 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius CWE-80 6.1 Medium 2022-03-14
CVE-2022-24743 Insufficient Session Expiration in Sylius CWE-613 7.1 High 2022-03-14
CVE-2022-24742 Exposure of Sensitive Information Due to Incompatible Policies in Sylius CWE-200 5.0 Medium 2022-03-14
CVE-2022-24733 Improper Restriction of Rendered UI Layers or Frames in Sylius CWE-1021 6.1 Medium 2022-03-14
CVE-2021-32720 List of order ids, number, items total and token value exposed for unauthorized uses via new API CWE-200 5.3 Medium 2021-06-28
CVE-2020-15245 Email verification bypass in Sylius CWE-79 4.3 Medium 2020-10-19
CVE-2020-5218 Ability in Sylius to switch channels via GET parameter enabled in production environments CWE-444 4.4 Medium 2020-01-27
CVE-2019-16768 Internal exception message exposure for login action in Sylius CWE-209 3.5 Low 2019-12-05

All 25 known CVE vulnerabilities affecting Sylius with full Chinese analysis, references, and POCs where available.