PatchTheCVEsparkshop vulnerabilities and fixes
Recent CVEs affecting sparkshop, with upgrade or downgrade steps. 5 tracked.
sparkshop has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-08-25. Highest priority: CVE-2025-50722 (score 58/100).
- CVE-2024-46307 HIGH 7.5 UPGRADE A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of produ
- CVE-2025-50722 CRITICAL 9.8 DOWNGRADE Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to execute arbitrary code via
- CVE-2024-57685 MEDIUM 5.3 UPGRADE An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar
- CVE-2024-48107 MEDIUM 6.5 UPGRADE SparkShop <=1.1.7 is vulnerable to server-side request forgery (SSRF)
- CVE-2024-40425 CRITICAL 9.8 UPGRADE File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C Mall v.1.1.6 and before
FAQ
How do I fix sparkshop vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sparkshop being exploited right now?
None of the tracked sparkshop CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which sparkshop CVE should I patch first?
CVE-2025-50722 currently ranks highest (58/100): Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to execute arbitrary code via.