CVE-2025-66572CWE-78command-injection

CVE-2025-66572

published December 5, 2025

CVSS
6.9
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victim's browser context when they visit a crafted URL.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
Not supplied
EPSS
0.00484 · 40.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-12-05T02:16Z
References (3)
https://loadedcommerce.com/ · [email protected]https://www.exploit-db.com/exploits/52084 · [email protected]https://www.vulncheck.com/advisories/loaded-commerce-66-client-side-template-injectioncsti · [email protected]
EPSS history
Timeline
  • 04 DEC 20:44Z
    Loaded Commerce 6.6 Client-Side Template Injection (CSTI)
    cvelistv5