UpHeron
All vulnerabilities

Servers and applications

CVE-2021-3841

sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser.

Severity
Medium 5.4
Published
15 Nov 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.9.10, 1.10.11, 1.11.2
Sources
NVD

Affected software

SoftwareAffected versions
SyliusServers and applications · cpe:a:sylius:sylius
  • Every version before 1.9.10
  • From 1.10.0 before 1.10.11
  • From 1.11.0 before 1.11.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-3841
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-3841