Webkul QloApps 1.5.2 - Cross-site Scripting

Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and emailcreate parameters in the AuthController.php file. id: CVE-2023-30256 info: name: Webkul QloApps 1.5.2 - Cross-site Scripting author: theamanrawat...

QloApps 1.6.0 - SQL Injection

An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameters datefrom, dateto, and idproduct allows a remote attacker to retrieve the contents of an entire database. id: CVE-2023-36284 info: name: QloApps 1.6.0 - SQL Injection author: ritikchaddha severity: high...

Webkul QloApps 1.6.0 - Cross-site Scripting

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST emailcreate and back parameter. id: CVE-2023-36289 info: name: Webkul QloApps 1.6.0 - Cross-site Scripting author:...

Webkul QloApps 1.6.0 - Cross-site Scripting

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter. id: CVE-2023-36287 info: name: Webkul QloApps 1.6.0 - Cross-site Scripting author: theamanrawa...

CVE-2023-30256

Webkul Qloapps 1.5.2 - Межсайтовый скриптинг XSS Webkul QloApps 1.5.2: уязвим к XSS в двух параметрах emailcreate и back Эксплойт - Proof of Concept POC XXS: параметр 'back' Payload Parameter back – Plain text: xss onfocus=alert1 autofocus= xss Payload Parameter back – URL Encoded:...

CVE-2026-107702

QloApps versions through 1.7.0 are vulnerable to an authorization bypass in the AdminHotelRoomsBookingController::postProcess() function. This flaw allows restricted back-office employees to access unauthorized data from other hotels by manipulating the id_hotel URL parameter on the Book Now page...

CVE-2026-107702 QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess that allows restricted back-office employees to access other hotels' data by supplying an idhotel parameter. Attackers can modify the idhotel URL parameter on the Book Now page to...

EUVD-2026-95138

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess that allows restricted back-office employees to access other hotels' data by supplying an idhotel parameter. Attackers can modify the idhotel URL parameter on the Book Now page to...

CVE-2026-105836

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

EUVD-2026-93380

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

CVE-2026-105836 QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

CVE-2026-105836

The QloApps application, through version 1.7.0 , is affected by an authorization bypass vulnerability within the AdminProductsController::ajaxProcessBulkUpdateRooms function. This flaw allows hotel-restricted back-office employees to modify room details for hotels outside of their own jurisdictio...

CVE-2026-105836 QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

PT-2026-106718

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id rooms parameter to change status, floor,...

CVE-2021-41074

CVE-2021-41074 CSRF в Qloapps HotelCommerce 1.5.1 В HotelCommerce 1.5.1 есть CSRF. Он может позволить кому угодно изменить email администратора. Если злоумышленник заставит администратора нажать на вредоносный HTML-документ, он сможет изменить email пользователя-администратора...

CVE-2025-67325

🚨 Неаутентифицированное удалённое выполнение кода RCE через загрузку файлов 📌 Обзор Проект: QloApps Репозиторий: https://github.com/Qloapps/QloApps Затронутые версии: = 1.7.0 Класс уязвимости: Неаутентифицированное удалённое выполнение кода Критичность: Критическая CVSS v3.1: Критическая 9.8...

RCE-QloApps-CVE-2024-40318

RCE-QloApps-CVE-2024-40318 Атака удаленного выполнения кода RCE позволяет злоумышленнику выполнять код на компьютере. Возможность выполнения кода может привести к развертыванию дополнительного вредоносного ПО, краже конфиденциальных данных или даже нанесению вреда серверу. Удаленное выполнение ко...

EUVD-2026-90435

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

EUVD-2026-90436

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

EUVD-2026-90437

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...