Skip to content
OpenAdvisories

Package · Packagist

sylius/mollie-plugin

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.5
    CVE-2026-68501

    Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

    Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFro…

    Sylius MolliePlugin sylius/mollie-plugin Packagist
  • High 7.5
    CVE-2026-68500

    Sylius Mollie Plugin: Payment status forgery via the payment webhook

    Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify…

    Sylius MolliePlugin sylius/mollie-plugin Packagist