CVE-2014-5140: Loadedcommerce LOADED7

High severity, CVSS 8.8. EPSS: 2.7% chance of exploitation in the next 30 days.

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book.

Affected products

• Loadedcommerce LOADED7: affected versions not specified

Published 2020-01-03. Last modified 2026-06-17.