Cross-site Request Forgery (CSRF)

sylius/resource-bundle is vulnerable to a Cross-Site Request Forgery. The vulnerability is due to the absence of proper validation and insufficient CSRF protection for actions such as marking order payments or product reviews in the AdminBundle and ResourceBundle. This allowing attackers to perfo...

Remote Code Execution (RCE)

sylius/resource-bundle is vulnerable to remote code execution RCE. The vulnerability exists as the value of $variable in OptionsParser.php is not sanitized...

Information Disclosure

sylius/resource-bundle is vulnerable to information disclosure. The vulnerability exists as ResourceBundle did not properly restrict the values of serializationgroups to be passed through the HTTP header...