CVE-2006-0478
CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct…
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the vulnerability on all known 6.0x and 6.1x releases. We strongly encourage users of CRE Loaded 6.x, osCMax, and other users of osCommerce who have installed HTMLArea based WYSIWYG editors and Admin Access with Levels to modify thier installations at the earliest possible moment."
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | High7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
- EPSS (exploitation in 30 days)
- 3.1% · top 12% of all CVEs (5 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
- n/a
Affected products
n/a
- affected n/a
References (6)
- creloaded-files-auth-bypass(24377) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
- 20060203 vendor ack/fix: 22793: CRE Loaded files.php Unauthenticated Arbitrary File Upload (fwd) (opens in a new tab)mailing-listx_refsource_VIMx_transferred
- 22793 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- ADV-2006-0373 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- 16415 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- 18648 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2006-0478)Record last updated .