3 matches found
CVE-2026-100872 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark t...
CVE-2026-100872 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark t...
CVE-2026-100872 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark t...