E-Commerce

Sylius/Sylius

Headless open-source eCommerce platform on top of PHP/Symfony/API Platform

#sylius#php#symfony#ecommerce#ecommerce-platform#shop#shopping-cart#framework#symfony-bundle#headless#headless-ecommerce#api#rest-api#restful-api#api-ecommerce#hacktoberfest

スコア

/ 100

Star

8,470

Fork

2,159

Open Issue

170

サイズ

353MB

言語

PHP ★

最終push

0 日前

Docker

🐳 compose ★

採点内訳

過去CVE 18件 (やや多い)

✓

直近 push: 0 日前

✓

得意言語 (PHP)

✓

オープンissue 170件

✓

大規模 (353MB)

—

Docker 対応 (compose)

✓

1k–10k: 初心者ベスト (★8,470)

✓

※ 各項目の重みは「採点ルール」を参照。合計は 0 で底打ち。

過去の SecurityAdvisory (18 件)

HIGHGHSA-7mp4-25j8-hp5q CVE-2026-318242026/3/9
Promotion Usage Limit Bypass via Race Condition
MEDIUMGHSA-xcwx-r2gw-w93m CVE-2026-318252026/3/9
DQL Injection via API Order Filters
MEDIUMGHSA-mx4q-xxc9-pf5q CVE-2026-318232026/3/9
Authenticated Stored XSS
LOWGHSA-vgh8-c6fp-7gcg CVE-2026-318222026/3/9
XSS vulnerability in checkout login form
MEDIUMGHSA-wjmg-4cq5-m8hg CVE-2026-318212026/3/9
Missing Authorization in API v2 Add Item Endpoint
HIGHGHSA-2xc6-348p-c2x6 CVE-2026-318202026/3/9
IDOR in Cart and Checkout LiveComponents
MEDIUMGHSA-9ffx-f77r-756w CVE-2026-318192026/3/9
Open Redirect via Referer Header
HIGHGHSA-55rf-8q29-4g43 CVE-2024-406332024/7/17
Ability to retrieve Adjustments with an incremental integer ID in an API endpoint
LOWGHSA-v2f9-rv6w-vw8r CVE-2024-343492024/5/10
Potential Cross Site Scripting (XSS) via the "Name" field (Taxons, Products, Options, Variants) in the Admin Panel
MEDIUMGHSA-7prj-9ccr-hr3q CVE-2024-293762024/5/10
Potential Cross Site Scripting (XSS) via the "Province" field in the Checkout and Address Book
MEDIUMGHSA-7563-75j9-6h5p CVE-2022-247422022/3/14
Exposure of sensitive information by using the back button after logging out in sylius/sylius
MEDIUMGHSA-4jp3-q2qm-9fmw CVE-2022-247332022/3/14
Missing HTTP headers to avoid login forms clickjacking
LOWGHSA-4qrp-27r3-66fj CVE-2022-247492022/3/14
Improper sanitize of SVG files during content upload ('Cross-site Scripting') in Sylius/Sylius
LOWGHSA-mf3v-f2qq-pf9g CVE-2022-247432022/3/14
Reset password token not set to null after reset password
MEDIUMGHSA-rpxh-vg2x-526v CVE-2021-327202021/6/28
List of order ids, number, items total and token value exposed for unauthorized uses via new API
LOWGHSA-6gw4-x63h-5499 CVE-2020-152452020/10/19
Ability to switch customer email address on account detail page and stay verified
LOWGHSA-prg5-hg25-8grq CVE-2020-52182020/1/27
Ability to switch channels via GET parameter enabled in production environments
LOWGHSA-3r8j-pmch-5j2h CVE-2019-167682019/12/5
Internal exception message exposure for login action