Read the docs

spree

Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

spree records in CISA KEV

No spree vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Spree 12 records HIGH Spree Auth Devise 1 record MEDIUM

Records

12 records in Spree · all components

TI-2011-04629 CVE-2011-10026 · GHSA-x485-rhg3-cqr4

Spreecommerce < 0.50.x API RCE

Priority HIGH 81

Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.03756 Published 2025-08-20 Fixed in 0.50.0 CWE-78
TI-2026-18150 CVE-2026-22589 · GHSA-3ghg-3787-w2xr

Spree API has Unauthenticated IDOR - Guest Address

Priority HIGH 72

Spree is an open source e-commerce solution built with Ruby on Rails.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0045 Published 2026-01-10 Fixed in 5.2.5, 5.1.9 +2 CWE-639
TI-2011-04622 CVE-2011-10019 · GHSA-97vm-c39p-jr86

Spreecommerce < 0.60.2 Search Parameter RCE

Priority MEDIUM 58

Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.06252 Published 2025-08-13 Fixed in 0.60.2 CWE-1321
TI-2020-16044 CVE-2020-26223 · GHSA-m2jr-hmc3-qmpr

Authorization bypass in Spree

Priority LOW 36

Spree is a complete open source e-commerce solution built with Ruby on Rails.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01124 Published 2020-11-13 Fixed in 3.7.13, 4.0.5 +1 CWE-863
TI-2010-03776 CVE-2010-3978 · GHSA-hwrx-wc75-mgh7

Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript…

Priority LOW 28

Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via ve…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02534 Published 2010-11-17 Fixed in 0.11.2, 0.30.0 CWE-200
TI-2008-06992 CVE-2008-7311 · GHSA-g466-57gh-cqfw

The session cookie store implementation in Spree 0.2.0 uses a hardcoded…

Priority LOW 25

The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanis…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0123 Published 2012-04-04 Fixed in 0.4.0 CWE-255
TI-2008-06991 CVE-2008-7310 · GHSA-7h48-m3rw-vr27

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's…

Priority LOW 25

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, rel…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0123 Published 2012-04-04 Fixed in 0.4.0 CWE-255
TI-2013-01457 CVE-2013-1656 · GHSA-jxx8-v83v-rhw3

Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to…

Priority LOW 23

Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01531 Published 2013-03-08 Fixed in 2.0.0.rc1 CWE-20
TI-2013-02246 CVE-2013-2506 · GHSA-jp57-9j37-5476

app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and…

Priority LOW 21

app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.01265 Published 2013-03-08 Fixed in 3.0.5 CWE-264
Open these records in search →