Vulnerability Database

CVE-2026-100872

github.com/sylius/sylius

Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite 27 Sep

Fix available
Severity - 8.7 (High)

CVE-2026-100871

github.com/sylius/sylius

Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication 27 Sep

Fix available
Severity - 8.7 (High)

CVE-2026-100870

github.com/sylius/sylius

Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header 27 Sep

Fix available
Severity - 8.7 (High)

CVE-2026-100869

github.com/sylius/sylius

Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API 27 Sep

Fix available
Severity - 8.2 (High)

CVE-2026-53637

github.com/sylius/sylius

Sylius: Cart FormComponent allows modification or deletion of an already-completed order 08 Sep

Fix available
Severity - 6.5 (Medium)

CVE-2026-53638

github.com/sylius/sylius

Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint 08 Sep

Fix available
Severity - 4.3 (Medium)

CVE-2026-53639

github.com/sylius/sylius

Sylius: IDOR on Shop Payment Request API endpoints 08 Sep

Fix available
Severity - 6.3 (Medium)

GHSA-x83g-979r-f5fh

Packagist/sylius/mollie-plugin

Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII 31 Jul

Fix available
Severity - 6.5 (Medium)

GHSA-rc52-c4hv-w89p

Packagist/sylius/mollie-plugin

Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook 31 Jul

Fix available
Severity - 7.5 (High)

CVE-2026-68501

github.com/sylius/mollieplugin

Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII 30 Jul

Fix available
Severity - 6.5 (Medium)

CVE-2026-68500

github.com/sylius/mollieplugin

Sylius Mollie Plugin: Payment status forgery via the payment webhook 30 Jul

Fix available
Severity - 7.5 (High)

GHSA-mr9r-h354-966r

Packagist/sylius/sylius

Sylius: IDOR on Shop Payment Request API endpoints 09 Jul

Fix available
Severity - 6.3 (Medium)

GHSA-6955-hrm5-c4qp

Packagist/sylius/sylius

Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint 09 Jul

Fix available
Severity - 4.3 (Medium)

GHSA-5597-7rmh-97q5

Packagist/sylius/sylius

Sylius: Cart FormComponent allows modification or deletion of an already-completed order 09 Jul

Fix available
Severity - 6.5 (Medium)

GHSA-xcwx-r2gw-w93m

Packagist/sylius/sylius

Sylius has a DQL Injection via API Order Filters 11 Mar

Fix available
Severity - 5.3 (Medium)

GHSA-7mp4-25j8-hp5q

Packagist/sylius/sylius

Sylius has a Promotion Usage Limit Bypass via Race Condition 11 Mar

Fix available
Severity - 8.2 (High)

Vulnerabilities