Spree has Remote Command Execution vulnerability in search functionality

🗓️ 13 Aug 2025 21:30:30Reported by GitHub Advisory DatabaseType

Spreecommerce versions before 0.60.2 have remote command execution via search[send][] input.

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2011-10019	13 Aug 202520:53	–	attackerkb
Circl	CVE-2011-10019	29 May 201815:50	–	circl
CNNVD	Spree Commerce 安全漏洞	13 Aug 202500:00	–	cnnvd
CVE	CVE-2011-10019	13 Aug 202520:53	–	cve
Cvelist	CVE-2011-10019 Spreecommerce < 0.60.2 Search Parameter RCE	13 Aug 202520:53	–	cvelist
EUVD	EUVD-2011-5240	7 Oct 202500:30	–	euvd
NVD	CVE-2011-10019	13 Aug 202521:15	–	nvd
OSV	GHSA-97VM-C39P-JR86 Spree has Remote Command Execution vulnerability in search functionality	13 Aug 202521:30	–	osv
Positive Technologies	PT-2025-33088 · Unknown · Spree Commerce	13 Aug 202500:00	–	ptsecurity
RedhatCVE	CVE-2011-10019	15 Aug 202521:29	–	redhatcve

Vulners

Node

spreecommerce spreeRange<0.60.2rubygems

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2011-10019
raw	www.raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/spree_search_exec.rb
web	www.web.archive.org/web/20111009192436/http://spreecommerce.com/blog/2011/10/05/remote-command-product-group
exploit-db	www.exploit-db.com/exploits/17941
vulncheck	www.vulncheck.com/advisories/spreecommerce-search-parameter-rce
github	www.github.com/orgs/spree
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2011-10019.yml
github	www.github.com/advisories/GHSA-97vm-c39p-jr86

13 Jan 2026 20:33Current

8High risk

Vulners AI Score8

CVSS 3.19.8

CVSS 410

EPSS0.6931

SSVC