Branches de versions concernées
Vulnérabilités connues
| CVE | Titre | Versions concernées | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|---|
| CVE-2026-108724 | Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint | ≤ 2.3.0 | 6.9 | — | 2026-10-11 | |
| CVE-2026-100872 | Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite | ≥ 2.0.0 < 2.1.16 ≥ 2.2.0 < 2.2.9 | 8.7 | — | 2026-09-27 | |
| CVE-2026-100871 | Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authenticat... | ≥ 1.11.0 < 1.12.25 ≥ 1.13.0 < 1.13.17 ≥ 1.14.0 < 1.14.20 | 8.7 | — | 2026-09-27 | |
| CVE-2026-100869 | Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API | ≥ 2.0.0 < 2.1.16 ≥ 2.2.0 < 2.2.9 | 8.2 | — | 2026-09-27 | |
| CVE-2026-100870 | Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header | ≥ 1.12.0 < 1.12.25 ≥ 1.13.0 < 1.13.17 ≥ 1.14.0 < 1.14.20 | 8.7 | — | 2026-09-27 | |
| CVE-2026-53637 | Sylius: Cart FormComponent allows modification or deletion of an already-completed order | * | 6.5 | — | 2026-09-09 | |
| CVE-2026-53638 | Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint | * | 4.3 | — | 2026-09-09 | |
| CVE-2026-53639 | Sylius: IDOR on Shop Payment Request API endpoints | * | 6.3 | — | 2026-09-09 | |
| CVE-2026-31825 | Sylius has a DQL Injection via API Order Filters | * | 5.3 | — | 2026-03-11 | |
| CVE-2026-31824 | Sylius has a Promotion Usage Limit Bypass via Race Condition | * | 8.2 | — | 2026-03-11 | |
| CVE-2026-31823 | Sylius has Authenticated Stored XSS | * | 4.8 | — | 2026-03-11 | |
| CVE-2026-31822 | Sylius has a XSS vulnerability in checkout login form | * | 5.3 | — | 2026-03-11 | |
| CVE-2026-31821 | Sylius is Missing Authorization in API v2 Add Item Endpoint | * | 6.9 | — | 2026-03-11 | |
| CVE-2026-31820 | Sylius affected by IDOR in Cart and Checkout LiveComponents | * | 7.1 | — | 2026-03-11 | |
| CVE-2026-31819 | Sylius has an Open Redirect via Referer Header | * | 6.9 | — | 2026-03-11 | |
| CVE-2024-57610 | A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on... | * | 7.5 | — | 2025-02-06 | |
| CVE-2021-3841 | Stored Cross-site Scripting (XSS) in sylius/sylius | * | 4.1 | — | 2024-11-15 | |
| CVE-2024-40633 | Customer data leak via adjustments API endpoint in Sylius | * | 5.3 | — | 2024-07-18 | |
| CVE-2024-34349 | Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) i... | * | 4.8 | — | 2024-05-11 | |
| CVE-2022-24749 | Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius | * | 6.1 | — | 2022-03-15 | |
| CVE-2022-24743 | Insufficient Session Expiration in Sylius | * | 7.1 | — | 2022-03-15 | |
| CVE-2022-24742 | Exposure of Sensitive Information Due to Incompatible Policies in Sylius | * | 5.0 | — | 2022-03-15 | |
| CVE-2022-24733 | Improper Restriction of Rendered UI Layers or Frames in Sylius | * | 6.1 | — | 2022-03-15 | |
| CVE-2021-32720 | List of order ids, number, items total and token value exposed for unauthorized uses via new API | * | 5.3 | — | 2021-06-29 | |
| CVE-2020-15245 | Email verification bypass in Sylius | * | 4.3 | — | 2020-10-20 | |
| CVE-2020-5218 | Ability in Sylius to switch channels via GET parameter enabled in production environments | * | 4.4 | — | 2020-01-28 | |
| CVE-2019-16768 | Internal exception message exposure for login action in Sylius | ≥ < 1.3.14 < 1.3.14 | 3.5 | — | 2019-12-06 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).