Skip to content
OpenAdvisories

Vendor

saleor

21 known vulnerabilities.

Products

saleor 17 saleor/saleor 1 storefront 1 requests-hardened 1 saleor/react-storefront 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.7
    CVE-2026-24136 Public exploit

    Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API

    Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulnerability that allows unauthenticated actors to extract sensitive information in …

    saleor saleor
  • High 8.5
    CVE-2026-23499 Public exploit

    Saleor vulnerable to stored XSS via Unrestricted File Upload

    Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor allowed authenticated staff users or Apps to upload arbitrary files, including malicious HTML and SVG files containing Javascript. Dependi…

    saleor saleor
  • High 7.2
    CVE-2026-22849 Public exploit

    Saleor lacks proper HTML sanitization in rich text fields

    Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perfor…

    saleor saleor
  • Medium 5.3
    CVE-2022-39275 Public exploit

    Improper object type validation in saleor

    Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to access database objects that the authenticated user may not be allowed to access. This vulnerability can…

    saleor saleor