Sylius vulnerabilities
We track 7 vulnerabilities in Sylius products across 3 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 27, 2026.
Latest Sylius vulnerabilities
- 7.5 High severity
Sylius: Insufficient Verification of Data Authenticity
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gatewa
- 8.8 High severity
Sylius: Improper Authentication
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and
- 8.8 High severity
Sylius: Weak Password Recovery Mechanism for Forgotten Password
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers
- 7.5 High severity
MolliePlugin: Authorization Bypass Through User-Controlled Key
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify
- 7.5 High severity
Sylius: Improper Restriction of Excessive Authentication Attempts
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate users. The Supplier's position is that th
- 9.8 Critical severity
SyliusGridBundle: Improper Neutralization of Special Elements used in an SQL Command
SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL inj
- 8.2 High severity
Sylius is an open source eCommerce platform.
Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and una