{"id":"CVE-2011-10019","title":"Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality","summary":"Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked …","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-94","CWE-1321"],"vendor":"spreecommerce","product":"spree","affected":["spree < 0.60.2"],"patched":["spree 0.60.2"],"published":"2025-08-13","updated":"2026-10-08","sourceUpdated":"2026-10-08T16:16:41.147","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2011-10019","references":[{"url":"https://github.com/orgs/spree","label":"disclosure@vulncheck.com"},{"url":"https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/spree_search_exec.rb","label":"disclosure@vulncheck.com"},{"url":"https://web.archive.org/web/20111009192436/http://spreecommerce.com/blog/2011/10/05/remote-command-product-group/","label":"disclosure@vulncheck.com"},{"url":"https://www.exploit-db.com/exploits/17941","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/spreecommerce-search-parameter-rce","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2025-08-14T13:45:30.960902Z"},"scores":{"nvd":9.8,"cna":10},"epss":0.05763,"epssPercentile":0.92881,"exploits":{"metasploit":["exploit/multi/http/spree_search_exec"],"checkedAt":"2026-10-08T16:52:49.755Z"},"exploitAvailable":true,"ingestedAt":"2026-10-08T16:52:14.664Z","slug":"CVE-2011-10019","body":"## Overview\n\nSpreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.\n\n## Affected\n\n- `spree < 0.60.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `spree 0.60.2`","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":53.9,"likelihood":1.2,"exploitation":12,"ransomware":0},"changes":[]}