{"action":"Upgrade sylius/paypal-plugin to 1.6.1 or later.","affected":[{"fixed":"1.6.1","introduced":"0"},{"fixed":"1.7.1","introduced":"1.7.0"},{"fixed":"2.0.1","introduced":"2.0.0"}],"component":"sylius/paypal-plugin","cve_ids":["CVE-2025-29788"],"ecosystem":"Packagist","epss":0.00502,"exploited":false,"fixed_versions":["1.6.1","1.7.1","2.0.1"],"ghsa_id":"GHSA-pqq3-q84h-pj6x","id":"tcs_01M5KF6KQ6MVZPTMGSA423D2WG","modified_at":"2026-09-10T03:49:48.531407377Z","published_at":"2025-03-17T21:26:50Z","references":["https://osv.dev/vulnerability/GHSA-pqq3-q84h-pj6x","https://github.com/Sylius/PayPalPlugin/security/advisories/GHSA-pqq3-q84h-pj6x","https://nvd.nist.gov/vuln/detail/CVE-2025-29788","https://github.com/Sylius/PayPalPlugin/commit/31e71b0457e5d887a6c19f8cfabb8b16125ec406","https://github.com/Sylius/PayPalPlugin/commit/8a81258f965b7860d4bccb52942e4c5b53e6774d","https://github.com/Sylius/PayPalPlugin","https://github.com/Sylius/PayPalPlugin/releases/tag/v1.6.1","https://github.com/Sylius/PayPalPlugin/releases/tag/v1.7.1","https://github.com/Sylius/PayPalPlugin/releases/tag/v2.0.1"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-pqq3-q84h-pj6x","url":"https://osv.dev/vulnerability/GHSA-pqq3-q84h-pj6x"}],"summary":"Sylius PayPal Plugin Payment Amount Manipulation Vulnerability"}