Spree

Vendor:

First CVE: Nov 17, 2010 · Active for 15 years

12
Total CVEs
More Total CVEs than 90% of tracked products
2.0
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
6.3
Avg CVSS
Higher Avg CVSS than 27% of tracked products
0.0%
KEV Rate
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Spree over time

Volume of CVEsAvg CVSS Base Score
First CVE
Nov 17, 2010
15 years ago
Most Recent CVE
Feb 6, 2026
169 days ago

CVE Severity & Scoring

Spree12 CVEs
All CVEs352,708 CVEs
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network7 (58.3%)
Unknown5 (41.7%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low7 (58.3%)
High0 (0.0%)
Unknown5 (41.7%)
User Interaction
None7 (58.3%)
Unknown5 (41.7%)
Required0 (0.0%)
Privileges Required
Low2 (16.7%)
High0 (0.0%)
None5 (41.7%)
Unknown5 (41.7%)

Top CVEs

Signals from CVEs in this product scope (12 CVEs).

12 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via th
Aug 13, 20259.847NOYES
Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbi
Aug 20, 20259.842NOYES
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR)
Jan 10, 20267.526NONO
Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bin
Feb 6, 20267.524NONO
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vu
Jan 8, 20266.523NONO
Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization byp
Nov 13, 20206.522NONO
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Or
Feb 6, 20265.319NONO
Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attacker
Nov 17, 20105.019NONO
Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the inten
Apr 5, 20125.018NONO
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to
Apr 5, 20125.017NONO

Exploit Exposure

Signals from CVEs in this product scope (12 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
2 CVEs
16.7% of CVEs· 97th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (12 CVEs).

Media Mentions

Signals from CVEs in this product scope (12 CVEs).

Top CNAs Publishing CVEs For Spree

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
1.3.214.01.3%00
1.3.124.21.4%00
1.3.024.21.4%00
1.2.424.21.4%00
1.2.324.21.4%00
1.2.224.21.4%00
1.2.124.21.4%00
1.2.024.21.4%00
1.1.624.21.4%00
1.1.524.21.4%00
1.1.424.21.4%00
1.1.324.21.4%00
1.1.224.21.4%00
1.1.124.21.4%00
1.1.024.21.4%00
1.0.714.31.5%00
1.0.614.31.5%00
1.0.514.31.5%00
1.0.414.31.5%00
1.0.314.31.5%00