Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 26
Reset filtersSylius: Channel-based payment method restriction bypass on shop account orders API endpoint
Sylius: Cart FormComponent allows modification or deletion of an already-completed order
Sylius has a DQL Injection via API Order Filters
Sylius has a Promotion Usage Limit Bypass via Race Condition
Sylius Vulnerable to Authenticated Stored XSS
Sylius has a XSS vulnerability in checkout login form
Sylius is Missing Authorization in API v2 Add Item Endpoint
Sylius affected by IDOR in Cart and Checkout LiveComponents
Sylius has an Open Redirect via Referer Header
Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout
Sylius PayPal Plugin Payment Amount Manipulation Vulnerability
Cross site scripting in sylius/sylius
Sylius has a security vulnerability via adjustments API endpoint
Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book
Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel
DQL injection through sorting parameters blocked
Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius
Insufficient Session Expiration in Sylius
Sensitive Information Exposure in Sylius
Improper Restriction of Rendered UI Layers or Frames in Sylius
List of order ids, number, items total and token value exposed for unauthorized uses via new API
Ability to switch customer email address on account detail page and stay verified
XSS injection in the Grid component of Sylius
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.