CVE Feed

    Dashboard / CVE / CVE-2026-31822

    CVE-2026-31822

    Sylius is an Open Source eCommerce Framework on Symfony. A cross-site scripting (XSS) vulnerability exists in the shop checkout login form handled by the ApiLoginController Stimulus controller. When a login attempt fails, AuthenticationFailureHandler returns a JSON response whose message field is rendered into the DOM using innerHTML, allowing any HTML or JavaScript in that value to be parsed and executed by the browser. The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.

    Published:Mar 10, 2026
    Last Modified:Apr 17, 2026
    EPS:Mar 10, 2026
    EPSS Score:0.00048
    CVSS Score:6.1

    Affected Products

    Vendor
    Sylius
    Product
    Sylius

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-53637 (CVSS 6.5) — Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, …
    CVE-2026-53638 (CVSS 4.3) — Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18…
    CVE-2026-53639 (CVSS 6.3) — Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18…
    CVE-2026-31825 (CVSS 5.3) — Sylius is an Open Source eCommerce Framework on Symfony. Sylius API filters ProductPriceOrderFilter and Transl…
    CVE-2026-31824 (CVSS 8.2) — Sylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use (TOCTOU) race conditio…
    CVE-2026-31823 (CVSS 4.8) — Sylius is an Open Source eCommerce Framework on Symfony. An authenticated stored cross-site scripting (XSS) vu…
    CVE-2026-31821 (CVSS 6.9) — Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpo…
    CVE-2026-31820 (CVSS 7.1) — Sylius is an Open Source eCommerce Framework on Symfony. An authenticated Insecure Direct Object Reference (ID…
    CVE-2026-31819 (CVSS 6.9) — Sylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(), Impersonate…
    CVE-2024-57610 (CVSS 7.5) — A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High