CVE-2021-41120

🗓️ 05 Oct 2021 20:35:10Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 132 Views🌐 WEB

sylius/paypal-plugin: Predictable Payment Page URL with PII Exposur

Reporter	Title	Published	Views	Family All 16
attackerkb	CVE-2021-41120	5 Oct 202121:15	–	attackerkb
Circl	CVE-2021-41120	6 Oct 202100:30	–	circl
CNNVD	Sylius information leakage vulnerability	5 Oct 202100:00	–	cnnvd
CNVD	Sylius Information Disclosure Vulnerability	1 Dec 202100:00	–	cnvd
Cvelist	CVE-2021-41120 Unauthorized access to Credit card form in sylius/paypal-plugin	5 Oct 202120:35	–	cvelist
EUVD	EUVD-2021-2137	7 Oct 202500:30	–	euvd
Github Security Blog	Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS	6 Oct 202117:49	–	github
Mend	CVE-2021-41120	5 Oct 202120:35	–	mend
NVD	CVE-2021-41120	5 Oct 202121:15	–	nvd
osv_cve	CVE-2021-41120	5 Oct 202121:15	–	osv_cve

NVD

Vulners

Node

sylius paypalRange1.0.0–1.2.4sylius

sylius paypalRange1.3.0–1.3.1sylius

[
  {
    "product": "PayPalPlugin",
    "vendor": "Sylius",
    "versions": [
      {
        "status": "affected",
        "version": ">= 1.0.0, < 1.2.4"
      },
      {
        "status": "affected",
        "version": ">= 1.3.0, < 1.3.1"
      }
    ]
  }
]

Source	Link
github	www.github.com/Sylius/PayPalPlugin/commit/2adc46be2764ccee22b4247139b8056fb8d1afff
github	www.github.com/Sylius/PayPalPlugin/security/advisories/GHSA-25fx-mxc2-76g7
github	www.github.com/Sylius/PayPalPlugin/commit/814923c2e9d97fe6279dcee866c34ced3d2fb7a7

Parameter	Position	Path	Description	CWE
{id}	path	/pay-with-paypal/{id}	Predictable payment ID in the URL allows for the exposure of personally identifiable information (PII) as the credit card form is not authenticated and prefills the customer's name.	CWE-200, CWE-639

17 Jun 2026 04:07Current

7.3High risk

Vulners AI Score7.3

CVSS 25

CVSS 3.17.5

EPSS0.01542