https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-31825.htmlhttps://patchthecve.com/cve/CVE-2026-31825.htmlWed, 17 Jun 2026 10:34:31 +0000MEDIUM 5.3: Sylius is an Open Source eCommerce Framework on Symfony. Sylius API filters ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter pass user-supplied order direction values directly to Doctrine's orderBy() without validation. An attacker can inject arbitrary DQL. The issue is fixed in versihttps://patchthecve.com/cve/CVE-2026-31824.htmlhttps://patchthecve.com/cve/CVE-2026-31824.htmlWed, 17 Jun 2026 10:34:31 +0000HIGH 8.2: Sylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use (TOCTOU) race condition was discovered in the promotion usage limit enforcement. The same class of vulnerability affects the promotion usage limit (the global used counter on Promotion entities), coupon usage limhttps://patchthecve.com/cve/CVE-2026-31823.htmlhttps://patchthecve.com/cve/CVE-2026-31823.htmlWed, 17 Jun 2026 10:34:31 +0000MEDIUM 4.8: Sylius is an Open Source eCommerce Framework on Symfony. An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple places across the shop frontend and admin panel due to unsanitized entity names being rendered as raw HTML. Shop breadcrumbs (shared/breadcrumbs.html.twig): Thhttps://patchthecve.com/cve/CVE-2026-31822.htmlhttps://patchthecve.com/cve/CVE-2026-31822.htmlWed, 17 Jun 2026 10:34:31 +0000MEDIUM 6.1: Sylius is an Open Source eCommerce Framework on Symfony. A cross-site scripting (XSS) vulnerability exists in the shop checkout login form handled by the ApiLoginController Stimulus controller. When a login attempt fails, AuthenticationFailureHandler returns a JSON response whose message field is rehttps://patchthecve.com/cve/CVE-2026-31821.htmlhttps://patchthecve.com/cve/CVE-2026-31821.htmlWed, 17 Jun 2026 10:34:31 +0000MEDIUM 5.3: Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An unauthenticated attacker can add items to other registered customers' carts by knowing the cart tokenValue. An attacker who obtains a cart tokenValue chttps://patchthecve.com/cve/CVE-2026-31820.htmlhttps://patchthecve.com/cve/CVE-2026-31820.htmlWed, 17 Jun 2026 10:34:31 +0000MEDIUM 6.5: Sylius is an Open Source eCommerce Framework on Symfony. An authenticated Insecure Direct Object Reference (IDOR) vulnerability exists in multiple shop LiveComponents due to unvalidated resource IDs accepted via #[LiveArg] parameters. Unlike props, which are protected by LiveComponent's @checksum, ahttps://patchthecve.com/cve/CVE-2026-31819.htmlhttps://patchthecve.com/cve/CVE-2026-31819.htmlWed, 17 Jun 2026 10:34:31 +0000MEDIUM 6.1: Sylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction() and StorageBasedLocaleSwitcher::handle() use the HTTP Referer header directly when redirecting. The attack requires the victim to click a legitimate applihttps://patchthecve.com/cve/CVE-2024-57610.htmlhttps://patchthecve.com/cve/CVE-2024-57610.htmlWed, 17 Jun 2026 08:13:45 +0000HIGH 7.5: A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate users. The Supplier's position is that the Sylius core software is not intended thttps://patchthecve.com/cve/CVE-2021-3841.htmlhttps://patchthecve.com/cve/CVE-2021-3841.htmlWed, 17 Jun 2026 04:05:52 +0000MEDIUM 5.4: sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser.https://patchthecve.com/cve/CVE-2024-29376.htmlhttps://patchthecve.com/cve/CVE-2024-29376.htmlWed, 17 Jun 2026 07:22:46 +0000MEDIUM 6.4: Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.