Skip to content
OpenAdvisories

Package · Packagist

sylius/sylius

23 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-31824

    Sylius has a Promotion Usage Limit Bypass via Race Condition

    Sylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use (TOCTOU) race condition was discovered in the promotion usage limit enforcement. The same class of vulnerability affects the promotion usage limit (the global used counter…

    Sylius Sylius sylius/sylius Packagist
  • High 7.1
    CVE-2026-31820

    Sylius affected by IDOR in Cart and Checkout LiveComponents

    Sylius is an Open Source eCommerce Framework on Symfony. An authenticated Insecure Direct Object Reference (IDOR) vulnerability exists in multiple shop LiveComponents due to unvalidated resource IDs accepted via #[LiveArg] parameters. Unlike props, which are …

    Sylius Sylius sylius/sylius Packagist
  • High 7.1
    CVE-2022-24743

    Insufficient Session Expiration in Sylius

    Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and un…

    Sylius Sylius sylius/sylius Packagist