CVE-2006-0478

CVE-2006-0478 describes a critical vulnerability in CRE Loaded 6.15, and potentially other osCommerce derivatives using HTMLArea WYSIWYG editors, where remote attackers can perform privileged actions, including arbitrary file uploads and creation, through a direct request to files.php. This vulnerability carries a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low attack complexity, and potential for partial confidentiality, integrity, and availability impacts. While not listed on the KEV catalog, an ExploitDB entry exists (EDB-1446) for an automated Perl exploit, suggesting exploit code is publicly available, though there is no evidence of widespread active exploitation or significant community discussion.