If you think that you have found a security issue in Sylius, please do not use the issue tracker and do not post it publicly. Instead, all security issues must be sent to security@sylius.com.
Please refer to the release process.
Security: Sylius/Sylius
Security
SECURITY.md
-
Ability to retrieve Adjustments with an incremental integer ID in an API endpointGHSA-55rf-8q29-4g43 published
Jul 17, 2024 by GSadeeHigh -
Potential Cross Site Scripting (XSS) via the "Name" field (Taxons, Products, Options, Variants) in the Admin PanelGHSA-v2f9-rv6w-vw8r published
May 10, 2024 by GSadeeLow -
Potential Cross Site Scripting (XSS) via the "Province" field in the Checkout and Address BookGHSA-7prj-9ccr-hr3q published
May 10, 2024 by GSadeeModerate -
Improper sanitize of SVG files during content upload ('Cross-site Scripting') in Sylius/SyliusGHSA-4qrp-27r3-66fj published
Mar 14, 2022 by lchruscielLow -
Reset password token not set to null after reset passwordGHSA-mf3v-f2qq-pf9g published
Mar 14, 2022 by lchruscielLow -
Missing HTTP headers to avoid login forms clickjackingGHSA-4jp3-q2qm-9fmw published
Mar 14, 2022 by lchruscielModerate -
Exposure of sensitive information by using the back button after logging out in sylius/syliusGHSA-7563-75j9-6h5p published
Mar 14, 2022 by lchruscielModerate -
List of order ids, number, items total and token value exposed for unauthorized uses via new APIGHSA-rpxh-vg2x-526v published
Jun 28, 2021 by pamilModerate -
Ability to switch customer email address on account detail page and stay verifiedGHSA-6gw4-x63h-5499 published
Oct 19, 2020 by lchruscielLow -
Ability to switch channels via GET parameter enabled in production environmentsGHSA-prg5-hg25-8grq published
Jan 27, 2020 by pamilLow
Learn more about advisories related to Sylius/Sylius in the GitHub Advisory Database