RCE in Loadedcommerce Loaded Commerce

CVE-2025-66572

Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victim's browser context when they visit a crafted URL.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.004 (35.5th percentile) — read the EPSS interpretation.

Affected products

Loadedcommerce Loaded Commerce — versions 6.6

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)