Skip to content
Threat Feed
Subscribe

Vendor

Sylius

2 briefs RSS
high advisory

Host Header Injection in Sylius Password Reset Mechanism

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 are vulnerable to a password reset poisoning attack, allowing unauthenticated attackers to hijack administrator accounts via Host header manipulation.

Sylius +1 vulnerability web-application account-takeover authentication-bypass privilege-escalation financial-fraud e-commerce cve-2026-100872
3t 1c
medium advisory

Sylius Mollie Plugin Payment Status Forgery Vulnerability

The Sylius Mollie Plugin is susceptible to an unauthenticated payment status forgery via the webhook handler, allowing attackers to mark arbitrary orders as paid by reusing valid payment IDs.

Sylius Mollie Plugin web-application e-commerce cve-2026-68500 logic-vulnerability
1r 1c