CVE-2009-5076: Creloaded Cre Loaded

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with (1) login.php or (2) password_forgotten.php appended as the PATH_INFO, which bypasses a check that uses PHP_SELF, which is not properly handled by (a) includes/application_top.php and (b) admin/includes/application_top.php, as exploited in the wild in 2009.

Affected products

• Creloaded Cre Loaded: up to and including 6.2; version 6.3 only; version 6.15 only

Published 2011-06-08. Last modified 2026-06-16.