Description
Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victim's browser context when they visit a crafted URL.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| loadedcommerce | Loaded Commerce | 6.6 | — |
References
- ExploitDB-52084 exploit
- Loaded Commerce Homepage product
- https://www.vulncheck.com/advisories/loaded-commerce-66-client-side-template-injectioncsti third-party-advisory