CVE-2024-57610

Falta de limitación de tasa en Sylius v2.0.2 Página de inicio del proveedor: https://sylius.com/ Pasos para reproducir 1. Navegue a https://store.sylius.com/login 2. Intente múltiples solicitudes de inicio de sesión utilizando herramientas o scripts automatizados por ejemplo, Burp Suite, cURL. 3...

CVE-2026-100870

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

CVE-2026-100869

Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains...

CVE-2026-100872

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark t...

CVE-2026-100871

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

CVE-2026-100872 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark t...

CVE-2026-100872

Sylius versions before 2.1.16 and 2.2.9 are vulnerable to an order total manipulation flaw. The system fails to validate payment amounts during cart recalculation , allowing unauthenticated attackers to modify order totals after a gateway transaction has been initiated. Specifically, an attacker ...

CVE-2026-100872 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark t...

EUVD-2026-87944

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark t...

CVE-2026-100872 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark t...

CVE-2026-100871 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

EUVD-2026-87943

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

CVE-2026-100871 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

CVE-2026-100871

Sylius versions before 1.12.25 , 1.13.17 , 1.14.20 , 2.1.16 , and 2.2.9 are vulnerable to a JWT audience confusion flaw. The application fails to include firewall identification in JWT tokens issued by the Admin and Shop API endpoints. An attacker can register a shop customer account using an adm...

CVE-2026-100871 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

CVE-2026-100869 Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API

Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains...

CVE-2026-100869

Sylius versions before 2.1.16 and 2.2.9 are vulnerable to an arbitrary payment action flaw in the Shop API endpoint . The root cause is a failure to restrict payment request actions, which allows customers possessing order tokens to trigger unauthorized actions, such as refunds , on completed ord...

CVE-2026-100870 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

CVE-2026-100869 Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API

Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains...

CVE-2026-100870

Sylius versions prior to 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 are vulnerable to administrator password-reset poisoning. The software builds password-reset links using the request Host header without proper validation. This allows unauthenticated attackers to use forged Host headers to red...