VULNERABILITY INTELLIGENCE
CVE-2025-66572
EPSS probability0.48%
CISA KEVNot currently listed
Published2025-12-04
Last modified2026-10-18
Description
Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victim's browser context when they visit a crafted URL.
Weakness classification
- disclosure@vulncheck.com: CWE-78