en
Sylius is an Open Source eCommerce framework on Symfony. It enables flexible, component-based commerce tooling and administration for custom storefronts and workflows, targeting developers and merchants needing a configurable platform.
As of 09/14/2026, Sylius recorded 5 security vulnerabilities in the last 90 days across 2 products, including 1 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Sylius had the most security vulnerabilities in the Sylius ecosystem, with 3 vulnerabilities—approximately 60% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-53637Sylius: Cart FormComponent allows modification or deletion of an already-completed order | Exploitation statusNot known exploited | FixNot confirmed | Affected productSylius | Published09/08/2026 | SeverityMedium |
CVE-2026-53638Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint | Exploitation statusNot confirmed | FixYes | Affected productSylius | Published09/08/2026 | SeverityMedium |
CVE-2026-53639Sylius: IDOR on Shop Payment Request API endpoints | Exploitation statusNot known exploited | FixYes | Affected productSylius | Published09/08/2026 | SeverityMedium |
CVE-2026-68501Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII | Exploitation statusPublic exploit | FixYes | Affected productMolliePlugin | Published07/30/2026 | SeverityMedium |
CVE-2026-68500Sylius Mollie Plugin: Payment status forgery via the payment webhook | Exploitation statusNot known exploited | FixYes | Affected productMolliePlugin | Published07/30/2026 | SeverityHigh |
CVE-2026-31825Sylius has a DQL Injection via API Order Filters | Exploitation statusPublic exploit | FixYes | Affected productSylius | Published03/10/2026 | SeverityMedium |
CVE-2026-31824Sylius has a Promotion Usage Limit Bypass via Race Condition | Exploitation statusNot known exploited | FixYes | Affected productSylius | Published03/10/2026 | SeverityHigh |
CVE-2026-31823Sylius has Authenticated Stored XSS | Exploitation statusNot known exploited | FixYes | Affected productSylius | Published03/10/2026 | SeverityMedium |
CVE-2026-31822Sylius has a XSS vulnerability in checkout login form | Exploitation statusNot known exploited | FixYes | Affected productSylius | Published03/10/2026 | SeverityMedium |
CVE-2026-31821Sylius is Missing Authorization in API v2 Add Item Endpoint | Exploitation statusPublic exploit | FixYes | Affected productSylius | Published03/10/2026 | SeverityMedium |
CVE-2026-31820Sylius affected by IDOR in Cart and Checkout LiveComponents | Exploitation statusNot known exploited | FixYes | Affected productSylius | Published03/10/2026 | SeverityHigh |
CVE-2026-31819Sylius has an Open Redirect via Referer Header | Exploitation statusNot known exploited | FixYes | Affected productSylius | Published03/10/2026 | SeverityMedium |
CVE-2025-30152Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout | Exploitation statusNot known exploited | FixYes | Affected productPayPalPlugin | Published03/19/2025 | SeverityMedium |
CVE-2025-29788Sylius PayPal Plugin Payment Amount Manipulation Vulnerability | Exploitation statusNot known exploited | FixYes | Affected productPayPalPlugin | Published03/17/2025 | SeverityMedium |
CVE-2024-57610 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/06/2025 | SeverityHigh |
CVE-2021-3841Stored Cross-site Scripting (XSS) in sylius/sylius | Exploitation statusNot known exploited | FixYes | Affected productsylius/sylius | Published11/15/2024 | SeverityMedium |
CVE-2024-40633Customer data leak via adjustments API endpoint in Sylius | Exploitation statusNot known exploited | FixYes | Affected productSylius | Published07/17/2024 | SeverityMedium |
CVE-2024-34349Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel | Exploitation statusNot known exploited | FixYes | Affected productSylius | Published05/10/2024 | SeverityMedium |
CVE-2024-29376 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published04/22/2024 | SeverityMedium |
CVE-2022-24752SQL Injection through sorting parameters in SyliusGridBundle | Exploitation statusNot known exploited | FixYes | Affected productSyliusGridBundle | Published03/15/2022 | SeverityCritical |
CVE-2022-24749Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius | Exploitation statusPublic exploit | FixYes | Affected productSylius | Published03/14/2022 | SeverityMedium |
CVE-2022-24743Insufficient Session Expiration in Sylius | Exploitation statusPublic exploit | FixYes | Affected productSylius | Published03/14/2022 | SeverityHigh |
CVE-2022-24742Exposure of Sensitive Information Due to Incompatible Policies in Sylius | Exploitation statusNot known exploited | FixYes | Affected productSylius | Published03/14/2022 | SeverityMedium |
CVE-2022-24733Improper Restriction of Rendered UI Layers or Frames in Sylius | Exploitation statusNot known exploited | FixYes | Affected productSylius | Published03/14/2022 | SeverityMedium |
CVE-2021-41120Unauthorized access to Credit card form in sylius/paypal-plugin | Exploitation statusNot confirmed | FixYes | Affected productPayPalPlugin | Published10/05/2021 | SeverityHigh |
CVE-2021-32720List of order ids, number, items total and token value exposed for unauthorized uses via new API | Exploitation statusNot confirmed | FixNot confirmed | Affected productSylius | Published06/28/2021 | SeverityMedium |
CVE-2020-15245Email verification bypass in Sylius | Exploitation statusNot confirmed | FixYes | Affected productSylius | Published10/19/2020 | SeverityMedium |
CVE-2020-15143Remote Code Execution in SyliusResourceBundle | Exploitation statusNot confirmed | FixNot confirmed | Affected productSyliusResourceBundle | Published08/19/2020 | SeverityHigh |
CVE-2020-15146Remote Code Execution in SyliusResourceBundle | Exploitation statusNot confirmed | FixNot confirmed | Affected productSyliusResourceBundle | Published08/19/2020 | SeverityCritical |
CVE-2020-5218Ability in Sylius to switch channels via GET parameter enabled in production environments | Exploitation statusNot confirmed | FixNot confirmed | Affected productSylius | Published01/27/2020 | SeverityMedium |
CVE-2020-5220Ability to expose data in Sylius by using an unintended serialisation group | Exploitation statusNot confirmed | FixNot confirmed | Affected productSyliusResourceBundle | Published01/27/2020 | SeverityMedium |
CVE-2019-12186 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/31/2019 | SeverityUnknown |
CVE-2019-16768Internal exception message exposure for login action in Sylius | Exploitation statusNot confirmed | FixYes | Affected productSylius | Published12/05/2019 | SeverityLow |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
