Sylius

Sylius

21 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.8

CVE-2024-34349

  • EPSS 0.07%
  • Veröffentlicht 14.05.2024 15:38:41
  • Zuletzt bearbeitet 15.04.2026 00:35:42

Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Produc...

6.4

CVE-2024-29376

Exploit
  • EPSS 0.11%
  • Veröffentlicht 22.04.2024 19:15:46
  • Zuletzt bearbeitet 15.09.2025 15:50:07

Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.

6.1

CVE-2022-24749

Exploit
  • EPSS 0.31%
  • Veröffentlicht 14.03.2022 22:15:07
  • Zuletzt bearbeitet 21.11.2024 06:51:00

Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has t...

8.2

CVE-2022-24743

Exploit
  • EPSS 0.22%
  • Veröffentlicht 14.03.2022 21:15:07
  • Zuletzt bearbeitet 21.11.2024 06:50:59

Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing tok...

5.5

CVE-2022-24742

  • EPSS 0.35%
  • Veröffentlicht 14.03.2022 20:15:08
  • Zuletzt bearbeitet 21.11.2024 06:50:59

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is av...

6.1

CVE-2022-24733

  • EPSS 0.29%
  • Veröffentlicht 14.03.2022 19:15:12
  • Zuletzt bearbeitet 21.11.2024 06:50:58

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page...

5.3

CVE-2021-32720

  • EPSS 0.22%
  • Veröffentlicht 28.06.2021 19:15:11
  • Zuletzt bearbeitet 21.11.2024 06:07:35

Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. I...

4.3

CVE-2020-15245

  • EPSS 0.17%
  • Veröffentlicht 19.10.2020 21:15:12
  • Zuletzt bearbeitet 21.11.2024 05:05:10

In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally diff...

4.3

CVE-2020-5218

  • EPSS 0.31%
  • Veröffentlicht 27.01.2020 21:15:11
  • Zuletzt bearbeitet 21.11.2024 05:33:42

Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no sylius_channel.debug is set e...

4.8

CVE-2019-12186

  • EPSS 0.35%
  • Veröffentlicht 31.12.2019 15:15:10
  • Zuletzt bearbeitet 21.11.2024 04:22:23

An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x throug...