CVE-2006-0478

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-01-31 · updated 2026-06-16

Description

CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the vulnerability on all known 6.0x and 6.1x releases. We strongly encourage users of CRE Loaded 6.x, osCMax, and other users of osCommerce who have installed HTMLArea based WYSIWYG editors and Admin Access with Levels to modify thier installations at the earliest possible moment."

Affected products

Cre Loaded: 6.15

References

http://secunia.com/advisories/18648
http://www.attrition.org/pipermail/vim/2006-February/000527.html
http://www.osvdb.org/22793
http://www.securityfocus.com/bid/16415
http://www.vupen.com/english/advisories/2006/0373
https://exchange.xforce.ibmcloud.com/vulnerabilities/24377
http://secunia.com/advisories/18648
http://www.attrition.org/pipermail/vim/2006-February/000527.html
http://www.osvdb.org/22793
http://www.securityfocus.com/bid/16415
http://www.vupen.com/english/advisories/2006/0373
https://exchange.xforce.ibmcloud.com/vulnerabilities/24377

Get alerted when CVE-2006-0478 or the next vulnerability affects your stack