Webkul QloApps 1.5.2 - Cross-site Scripting

Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and emailcreate parameters in the AuthController.php file. id: CVE-2023-30256 info: name: Webkul QloApps 1.5.2 - Cross-site Scripting author: theamanrawat...

QloApps 1.6.0 - SQL Injection

An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameters datefrom, dateto, and idproduct allows a remote attacker to retrieve the contents of an entire database. id: CVE-2023-36284 info: name: QloApps 1.6.0 - SQL Injection author: ritikchaddha severity: high...

Webkul QloApps 1.6.0 - Cross-site Scripting

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST emailcreate and back parameter. id: CVE-2023-36289 info: name: Webkul QloApps 1.6.0 - Cross-site Scripting author:...

Webkul QloApps 1.6.0 - Cross-site Scripting

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter. id: CVE-2023-36287 info: name: Webkul QloApps 1.6.0 - Cross-site Scripting author: theamanrawa...

CVE-2021-41074

CVE-2021-41074 CSRF в Qloapps HotelCommerce 1.5.1 В HotelCommerce 1.5.1 есть CSRF. Он может позволить кому угодно изменить email администратора. Если злоумышленник заставит администратора нажать на вредоносный HTML-документ, он сможет изменить email пользователя-администратора...

CVE-2023-30256

Webkul Qloapps 1.5.2 - Межсайтовый скриптинг XSS Webkul QloApps 1.5.2: уязвим к XSS в двух параметрах emailcreate и back Эксплойт - Proof of Concept POC XXS: параметр 'back' root@kitploit: Payload Parameter back – Plain text: xss onfocus=alert1 autofocus= xss Payload Parameter back – URL Encoded:...

CVE-2026-92234

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the...

CVE-2026-92234

QloApps versions through 1.7.0 contain a reflected cross-site scripting (XSS) vulnerability in the Hotel Reservation System feature management page (back-office). The child_features parameter is reflected unescaped into validation error messages, allowing an authenticated back-office user who fol...

CVE-2026-92234 QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the...

EUVD-2026-80002

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the...

CVE-2026-92234 QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the...

CVE-2025-67325

🚨 파일 업로드를 통한 인증되지 않은 원격 코드 실행 RCE 📌 개요 프로젝트: QloApps 저장소: https://github.com/Qloapps/QloApps 영향을 받는 버전: = 1.7.0 취약점 종류: 인증되지 않은 원격 코드 실행 심각도: 치명적 CVSS v3.1: 치명적 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE ID: CVE-2025-67325 발견자: Neakk Pornlur 공개일: 2026-01-09 🧩 설명 QloApps 1.7.0 및 이전 버전의 호...

RCE-QloApps-CVE-2024-40318

RCE-QloApps-CVE-2024-40318 Атака удаленного выполнения кода RCE позволяет злоумышленнику выполнять код на компьютере. Возможность выполнения кода может привести к развертыванию дополнительного вредоносного ПО, краже конфиденциальных данных или даже нанесению вреда серверу. Удаленное выполнение ко...

CVE-2026-89268

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

EUVD-2026-76773

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

CVE-2026-89268

QloApps through 1.7.0 contains a reflected cross-site scripting (XSS) vulnerability in the back-office list helper template (list_header.tpl). POST parameters from list filter forms are rendered into HTML value attributes without escaping , allowing an attacker to induce an authenticated user to ...

CVE-2026-89268 QloApps through 1.7.0 Reflected XSS via List Filter Parameters

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

CVE-2026-89268 QloApps through 1.7.0 Reflected XSS via List Filter Parameters

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

PT-2026-90554

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

CVE-2026-75496

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c...