CVE-2022-28888

Spryker Commerce OS 1.4.2 allows Remote Command Execution.

• CWE-78

• http://packetstormsecurity.com/files/167765/Spryker-Commerce-OS-Remote-Command-Execution.htmlExploit, Third Party Advisory
• http://packetstormsecurity.com/files/172257/Spryker-Commerce-OS-1.0-SQL-Injection.html
• http://seclists.org/fulldisclosure/2022/Jul/4Third Party Advisory
• http://seclists.org/fulldisclosure/2023/May/2
• https://schutzwerk.comExploit, Not Applicable
• https://www.schutzwerk.com/en/43/advisories/schutzwerk-sa-2022-003/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/167765/Spryker-Commerce-OS-Remote-Command-Execution.htmlExploit, Third Party Advisory
• http://packetstormsecurity.com/files/172257/Spryker-Commerce-OS-1.0-SQL-Injection.html
• http://seclists.org/fulldisclosure/2022/Jul/4Third Party Advisory
• http://seclists.org/fulldisclosure/2023/May/2
• https://schutzwerk.comExploit, Not Applicable
• https://www.schutzwerk.com/en/43/advisories/schutzwerk-sa-2022-003/Exploit, Third Party Advisory

Published

Jul 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28882A Denial-of-Service (DoS) vulnerability was discovered in F-…7.5
• CVE-2022-28883A Denial-of-Service (DoS) vulnerability was discovered in F-…7.5
• CVE-2022-28884A Denial-of-Service vulnerability was discovered in the F-Se…7.5
• CVE-2022-28885A Denial-of-Service (DoS) vulnerability was discovered in th…7.5
• CVE-2022-28886A Denial-of-Service vulnerability was discovered in the F-Se…5.5
• CVE-2022-28887Multiple Denial-of-Service (DoS) vulnerability was discovere…7.5
• CVE-2022-28889In Apache Druid 0.22.1 and earlier, the server did not set a…4.3
• CVE-2022-2889Use After Free in GitHub repository vim/vim prior to 9.0.022…7.8
• CVE-2022-28890A vulnerability in the RDF/XML parser of Apache Jena allows …9.8
• CVE-2022-28892Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vuln…8.8
• CVE-2022-28893The SUNRPC subsystem in the Linux kernel through 5.17.2 can …7.8
• CVE-2022-28895A command injection vulnerability in the component /setnetwo…9.8