PatchTheCVEsparkshop vulnerabilities
Recent CVEs affecting sparkshop products. 4 tracked.
sparkshop has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-08-25. Highest priority: CVE-2025-50722 (score 58/100).
- CVE-2024-46307 HIGH 7.5 UPGRADE A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of produ
- CVE-2025-50722 CRITICAL 9.8 DOWNGRADE Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to execute arbitrary code via
- CVE-2024-57685 MEDIUM 5.3 UPGRADE An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar
- CVE-2024-48107 MEDIUM 6.5 UPGRADE SparkShop <=1.1.7 is vulnerable to server-side request forgery (SSRF)
FAQ
How do I fix sparkshop vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sparkshop being exploited right now?
None of the tracked sparkshop CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which sparkshop CVE should I patch first?
CVE-2025-50722 currently ranks highest (58/100): Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to execute arbitrary code via.