CVE-2006-0478 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 3.1% (pctl 87)
Patch early
A public exploit exists.
Description
CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the vulnerability on all known 6.0x and 6.1x releases. We strongly encourage users of CRE Loaded 6.x, osCMax, and other users of osCommerce who have installed HTMLArea based WYSIWYG editors and Admin Access with Levels to modify thier installations at the earliest possible moment."
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 3.07% — more likely to be exploited than 87% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-01-31 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| cre loaded | cre loaded |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | creLoaded 6.15 - 'HTMLAREA' Automated Perl | 2006-01-24 |
References
- http://secunia.com/advisories/18648
- http://www.attrition.org/pipermail/vim/2006-February/000527.html
- http://www.osvdb.org/22793
- http://www.securityfocus.com/bid/16415
- http://www.vupen.com/english/advisories/2006/0373
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24377
- http://secunia.com/advisories/18648
- http://www.attrition.org/pipermail/vim/2006-February/000527.html
- http://www.osvdb.org/22793
- http://www.securityfocus.com/bid/16415
- http://www.vupen.com/english/advisories/2006/0373
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24377
→ the Explorer · watch your stack · NVD