Skip to content
Noroxi

Sylius records

25 published records for vendor sylius.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
96%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

25 records
  • CVE-2022-24752
    39Monitor

    SQL Injection through sorting parameters in SyliusGridBundle

    CriticalCVSS 9.8No exploitEPSS 1%

    sylius · syliusgridbundleMar 15, 2022

  • CVE-2020-15146
    36Monitor

    Remote Code Execution in SyliusResourceBundle

    HighCVSS 8.8No exploitEPSS 2%

    sylius · syliusresourcebundleAug 19, 2020

  • CVE-2020-15143
    36Monitor

    Remote Code Execution in SyliusResourceBundle

    HighCVSS 8.8No exploitEPSS 1%

    sylius · syliusresourcebundleAug 19, 2020

  • CVE-2022-24743
    32Monitor

    Insufficient Session Expiration in Sylius

    HighCVSS 8.2No exploitEPSS 1%

    sylius · syliusMar 14, 2022

  • CVE-2021-41120
    30Monitor

    Unauthorized access to Credit card form in sylius/paypal-plugin

    HighCVSS 7.5No exploitEPSS 1%

    sylius · paypalOct 5, 2021

  • CVE-2024-57610
    30Monitor

    A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly

    HighCVSS 7.5Proof of conceptEPSS 1%

    sylius · syliusFeb 6, 2025

  • CVE-2026-31820
    28Monitor

    Sylius affected by IDOR in Cart and Checkout LiveComponents

    HighCVSS 7.1No exploitEPSS 0%

    sylius · syliusMar 10, 2026

  • CVE-2026-31821
    27Monitor

    Sylius is Missing Authorization in API v2 Add Item Endpoint

    MediumCVSS 6.9No exploitEPSS 0%

    sylius · syliusMar 10, 2026

  • CVE-2026-31819
    27Monitor

    Sylius has an Open Redirect via Referer Header

    MediumCVSS 6.9No exploitEPSS 0%

    sylius · syliusMar 10, 2026

  • CVE-2024-29376
    25Monitor

    Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.

    MediumCVSS 6.4No exploitEPSS 0%

    sylius · syliusApr 22, 2024

  • CVE-2022-24749
    24Monitor

    Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius

    MediumCVSS 6.1No exploitEPSS 1%

    sylius · syliusMar 14, 2022

  • CVE-2022-24733
    24Monitor

    Improper Restriction of Rendered UI Layers or Frames in Sylius

    MediumCVSS 6.1No exploitEPSS 0%

    sylius · syliusMar 14, 2022

  • CVE-2026-31824
    23Monitor

    Sylius has a Promotion Usage Limit Bypass via Race Condition

    MediumCVSS 5.9No exploitEPSS 0%

    sylius · syliusMar 10, 2026

  • CVE-2022-24742
    22Monitor

    Exposure of Sensitive Information Due to Incompatible Policies in Sylius

    MediumCVSS 5.5No exploitEPSS 0%

    sylius · syliusMar 14, 2022

  • CVE-2021-32720
    21Monitor

    List of order ids, number, items total and token value exposed for unauthorized uses via new API

    MediumCVSS 5.3No exploitEPSS 0%

    sylius · syliusJun 28, 2021

  • CVE-2020-5220
    21Monitor

    Ability to expose data in Sylius by using an unintended serialisation group

    MediumCVSS 5.3No exploitEPSS 0%

    sylius · syliusresourcebundleJan 27, 2020

  • CVE-2024-40633
    21Monitor

    Customer data leak via adjustments API endpoint in Sylius

    MediumCVSS 5.3No exploitEPSS 0%

    sylius · syliusJul 17, 2024

  • CVE-2021-3841
    21Monitor

    Stored Cross-site Scripting (XSS) in sylius/sylius

    MediumCVSS 5.4No exploitEPSS 0%

    sylius · syliusNov 15, 2024

  • CVE-2026-31825
    21Monitor

    Sylius has a DQL Injection via API Order Filters

    MediumCVSS 5.3No exploitEPSS 0%

    sylius · syliusMar 10, 2026

  • CVE-2026-31822
    21Monitor

    Sylius has a XSS vulnerability in checkout login form

    MediumCVSS 5.3No exploitEPSS 0%

    sylius · syliusMar 10, 2026

  • CVE-2019-12186
    19Monitor

    An issue was discovered in Sylius products.

    MediumCVSS 4.8No exploitEPSS 0%

    sylius · gridDec 31, 2019

  • CVE-2026-31823
    19Monitor

    Sylius has Authenticated Stored XSS

    MediumCVSS 4.8No exploitEPSS 0%

    sylius · syliusMar 10, 2026

  • CVE-2019-16768
    17Monitor

    Internal exception message exposure for login action in Sylius

    MediumCVSS 4.3No exploitEPSS 0%

    sylius · syliusDec 5, 2019

  • CVE-2020-15245
    17Monitor

    Email verification bypass in Sylius

    MediumCVSS 4.3No exploitEPSS 0%

    sylius · syliusOct 19, 2020

  • CVE-2020-5218
    17Monitor

    Ability in Sylius to switch channels via GET parameter enabled in production environments

    MediumCVSS 4.3No exploitEPSS 0%

    sylius · syliusJan 27, 2020