BaseFortify

Publication date: 2025-12-04

Last updated on: 2026-05-26

Assigner: VulnCheck

Description

Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victim's browser context when they visit a crafted URL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-04

Last Modified

2026-05-26

Generated

2026-07-06

AI Q&A

2025-12-04

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66572

Affected Vendors & Products

Vendor	Product	Version / Range
loaded_commerce	loaded_commerce	6.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a client-side template injection in Loaded Commerce 6.6 that allows unauthenticated attackers to execute code on the server by manipulating the search parameter.

Impact Analysis

An attacker exploiting this vulnerability can execute arbitrary code on the server without authentication, potentially leading to unauthorized access, data compromise, or disruption of service.

Hi! I’m here to help you understand CVE-2025-66572. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70