Spreecommerce
Approved changes feed: RSS · Atom
cpe:2.3:a:spreecommerce:spreecommerce:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Spreecommerce (f92391b1-1e40-5f79-b6e8-34a9838506d5) |
|---|---|
| Product | Spreecommerce (4189f440-90d6-54db-b6f3-ac3b6b6c8a26) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2011-10026 |
vulnerable | 2026-06-08 04:56:40.600530 |
Spreecommerce < 0.50.x API RCE
Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Ruby’s send method. This flaw enables unauthenticated attackers to execute commands on the server.
Published: 2025-08-20T15:41:40.151Z
Updated: 2026-05-15T11:13:45.921Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2011-10019 |
vulnerable | 2026-06-08 04:56:40.592766 |
Spreecommerce < 0.60.2 Search Parameter RCE
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
Published: 2025-08-13T20:53:33.577Z
Updated: 2026-05-15T11:13:42.139Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.