Vulnerabilities

TI-2025-32230 CVE-2025-50722 · GHSA-cvmh-rq8x-hpjr

Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to…

HIGH 82

Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to execute arbitrary code via the Common.php component

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00775 Published 2025-08-25 No fix listed CWE-77

TI-2024-38029 CVE-2024-57685 · GHSA-9733-vpvw-5rpc

An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar file.

LOW 26

An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar file.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0044 Published 2025-02-24 No fix listed CWE-77

TI-2024-32270 CVE-2024-48107 · GHSA-q2q9-q8mv-pv59

SparkShop <=1.1.7 is vulnerable to server-side request forgery (SSRF).

LOW 28

SparkShop <=1.1.7 is vulnerable to server-side request forgery (SSRF).

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00226 Published 2024-10-28 No fix listed CWE-918

TI-2024-30924 CVE-2024-46307 · GHSA-3j3r-8qhc-763h

A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products.

HIGH 72

A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00458 Published 2024-10-09 No fix listed CWE-841

TI-2024-26917 CVE-2024-40425 · GHSA-87jg-pj33-j4xf

File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C…

HIGH 82

File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary code via the contorller/common.php component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00711 Published 2024-07-16 No fix listed CWE-434

Vulnerabilities

Filters

Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to…

An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar file.

SparkShop <=1.1.7 is vulnerable to server-side request forgery (SSRF).

A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products.

File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C…