# sylius/sylius (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/sylius-sylius Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/sylius-sylius.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 25 vulnerabilities in sylius/sylius (Packagist): 0 in the last 7 days and 3 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-53639, was published on 8 September 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 3 - All time: 25 (0 critical, 0 exploited in the wild) ## About sylius/sylius (Packagist) Sylius is an open-source e-commerce platform based on the Symfony framework. ## Latest sylius/sylius (Packagist) vulnerabilities - [CVE-2026-53639: Sylius IDOR in Shop Payment Request API endpoints](https://junglewise.ai/threats/cve-2026-53639-sylius-idor-in-shop-payment-request-api-endpoints) (medium, CVSS 4, published 8 Sep 2026) - [CVE-2026-53638: Sylius authorization bypass in shop account orders API](https://junglewise.ai/threats/cve-2026-53638-sylius-authorization-bypass-in-shop-account-orders-api) (medium, CVSS 4.3, published 8 Sep 2026) - [CVE-2026-53637: Sylius Cart FormComponent order modification and deletion](https://junglewise.ai/threats/cve-2026-53637-sylius-cart-formcomponent-order-modification-and-deletion) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-31825: Sylius has a DQL Injection via API Order Filters](https://junglewise.ai/threats/cve-2026-31825-sylius-has-a-dql-injection-via-api-order-filters) (low, CVSS 3.1, published 11 Mar 2026) - [CVE-2026-31824: Sylius has a Promotion Usage Limit Bypass via Race Condition](https://junglewise.ai/threats/cve-2026-31824-sylius-has-a-promotion-usage-limit-bypass-via-race-condition) (low, CVSS 3.1, published 11 Mar 2026) - [CVE-2026-31823: Sylius Vulnerable to Authenticated Stored XSS](https://junglewise.ai/threats/cve-2026-31823-sylius-vulnerable-to-authenticated-stored-xss) (low, CVSS 3.1, published 11 Mar 2026) - [CVE-2026-31822: Sylius has a XSS vulnerability in checkout login form](https://junglewise.ai/threats/cve-2026-31822-sylius-has-a-xss-vulnerability-in-checkout-login-form) (medium, CVSS 4, published 11 Mar 2026) - [CVE-2026-31821: Sylius is Missing Authorization in API v2 Add Item Endpoint](https://junglewise.ai/threats/cve-2026-31821-sylius-is-missing-authorization-in-api-v2-add-item-endpoint) (medium, CVSS 4, published 11 Mar 2026) - [CVE-2026-31820: Sylius affected by IDOR in Cart and Checkout LiveComponents](https://junglewise.ai/threats/cve-2026-31820-sylius-affected-by-idor-in-cart-and-checkout-livecomponents) (medium, CVSS 4, published 11 Mar 2026) - [CVE-2026-31819: Sylius has an Open Redirect via Referer Header](https://junglewise.ai/threats/cve-2026-31819-sylius-has-an-open-redirect-via-referer-header) (medium, CVSS 4, published 11 Mar 2026) - [CVE-2024-57610: Withdrawn Advisory: Sylius allows unrestricted brute-force attacks on user accounts](https://junglewise.ai/threats/cve-2024-57610-withdrawn-advisory-sylius-allows-unrestricted-brute-force-attacks) (medium, CVSS 4, published 6 Feb 2025) - [CVE-2021-3841: Cross site scripting in sylius/sylius](https://junglewise.ai/threats/cve-2021-3841-cross-site-scripting-in-sylius-sylius) (low, CVSS 3, published 15 Nov 2024) - [CVE-2024-40633: Sylius has a security vulnerability via adjustments API endpoint](https://junglewise.ai/threats/cve-2024-40633-sylius-has-a-security-vulnerability-via-adjustments-api-endpoint) (low, CVSS 3.1, published 17 Jul 2024) - [CVE-2024-29376: Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book](https://junglewise.ai/threats/cve-2024-29376-sylius-has-potential-cross-site-scripting-vulnerability-via-the) (info, published 10 May 2024) - [CVE-2024-34349: Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel](https://junglewise.ai/threats/cve-2024-34349-sylius-potentially-vulnerable-to-cross-site-scripting-via-name) (low, CVSS 3.1, published 10 May 2024) - [Duplicate Advisory: Sylius Cross Site Scripting (XSS) vulnerability](https://junglewise.ai/threats/duplicate-advisory-sylius-cross-site-scripting-xss-vulnerability-20aa7288) (low, CVSS 3.1, published 22 Apr 2024) - [CVE-2022-24749: Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius](https://junglewise.ai/threats/cve-2022-24749-improper-sanitize-of-svg-files-during-content-upload-cross-site) (low, CVSS 3.1, published 14 Mar 2022) - [CVE-2022-24743: Insufficient Session Expiration in Sylius](https://junglewise.ai/threats/cve-2022-24743-insufficient-session-expiration-in-sylius) (low, CVSS 3.1, published 14 Mar 2022) - [CVE-2022-24742: Sensitive Information Exposure in Sylius](https://junglewise.ai/threats/cve-2022-24742-sensitive-information-exposure-in-sylius) (low, CVSS 3.1, published 14 Mar 2022) - [CVE-2022-24733: Improper Restriction of Rendered UI Layers or Frames in Sylius](https://junglewise.ai/threats/cve-2022-24733-improper-restriction-of-rendered-ui-layers-or-frames-in-sylius) (low, CVSS 3.1, published 14 Mar 2022) - [CVE-2021-32720: List of order ids, number, items total and token value exposed for unauthorized uses via new API](https://junglewise.ai/threats/cve-2021-32720-list-of-order-ids-number-items-total-and-token-value-exposed-for) (low, CVSS 3.1, published 29 Jun 2021) - [CVE-2020-15245: Ability to switch customer email address on account detail page and stay verified](https://junglewise.ai/threats/cve-2020-15245-ability-to-switch-customer-email-address-on-account-detail-page) (low, CVSS 3.1, published 19 Oct 2020) - [CVE-2019-12186: XSS injection in the Grid component of Sylius](https://junglewise.ai/threats/cve-2019-12186-xss-injection-in-the-grid-component-of-sylius) (low, CVSS 3.1, published 15 Apr 2020) - [CVE-2020-5218: Ability to switch channels via GET parameter enabled in production environments](https://junglewise.ai/threats/cve-2020-5218-ability-to-expose-data-in-sylius-by-using-an-unintended) (low, CVSS 3.1, published 31 Jan 2020) - [CVE-2019-16768: Internal exception message exposure for login action in Sylius](https://junglewise.ai/threats/cve-2019-16768-internal-exception-message-exposure-for-login-action-in-sylius) (low, CVSS 3.1, published 5 Dec 2019) ## Most severe sylius/sylius (Packagist) vulnerabilities - [CVE-2026-53637: Sylius Cart FormComponent order modification and deletion](https://junglewise.ai/threats/cve-2026-53637-sylius-cart-formcomponent-order-modification-and-deletion) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-53638: Sylius authorization bypass in shop account orders API](https://junglewise.ai/threats/cve-2026-53638-sylius-authorization-bypass-in-shop-account-orders-api) (medium, CVSS 4.3, published 8 Sep 2026) - [CVE-2024-57610: Withdrawn Advisory: Sylius allows unrestricted brute-force attacks on user accounts](https://junglewise.ai/threats/cve-2024-57610-withdrawn-advisory-sylius-allows-unrestricted-brute-force-attacks) (medium, CVSS 4, published 6 Feb 2025) - [CVE-2026-53639: Sylius IDOR in Shop Payment Request API endpoints](https://junglewise.ai/threats/cve-2026-53639-sylius-idor-in-shop-payment-request-api-endpoints) (medium, CVSS 4, published 8 Sep 2026) - [CVE-2026-31820: Sylius affected by IDOR in Cart and Checkout LiveComponents](https://junglewise.ai/threats/cve-2026-31820-sylius-affected-by-idor-in-cart-and-checkout-livecomponents) (medium, CVSS 4, published 11 Mar 2026) - [CVE-2026-31821: Sylius is Missing Authorization in API v2 Add Item Endpoint](https://junglewise.ai/threats/cve-2026-31821-sylius-is-missing-authorization-in-api-v2-add-item-endpoint) (medium, CVSS 4, published 11 Mar 2026) - [CVE-2026-31819: Sylius has an Open Redirect via Referer Header](https://junglewise.ai/threats/cve-2026-31819-sylius-has-an-open-redirect-via-referer-header) (medium, CVSS 4, published 11 Mar 2026) - [CVE-2026-31822: Sylius has a XSS vulnerability in checkout login form](https://junglewise.ai/threats/cve-2026-31822-sylius-has-a-xss-vulnerability-in-checkout-login-form) (medium, CVSS 4, published 11 Mar 2026) - [CVE-2022-24743: Insufficient Session Expiration in Sylius](https://junglewise.ai/threats/cve-2022-24743-insufficient-session-expiration-in-sylius) (low, CVSS 3.1, published 14 Mar 2022) - [CVE-2022-24749: Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius](https://junglewise.ai/threats/cve-2022-24749-improper-sanitize-of-svg-files-during-content-upload-cross-site) (low, CVSS 3.1, published 14 Mar 2022) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 3 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "sylius/sylius (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/sylius-sylius, 9 November 2026.