Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: loadedcommerce Clear all filters
TI-2025-40982 CVE-2025-66572 · GHSA-848h-rrwq-hgjw

Loaded Commerce 6.6 Client-Side Template Injection (CSTI)

Priority HIGH 70

Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victim's browser context when they visit a craft…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00519 Published 2025-12-04 No fix listed CWE-78
TI-2014-04204 CVE-2014-5140 · GHSA-jq73-v9pp-jgx4

The bindReplace function in the query factory in includes/classes/database.php in Loaded…

Priority MEDIUM 43

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote authenticated users to conduct SQL injection attacks…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02682 Published 2020-01-03 No fix listed CWE-89