164 matches found
CVE-2025-1074 Webkul QloApps URL mylogout cross-site request forgery
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the component URL Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been...
PT-2025-5824 · Webkul · Webkul Qloapps
Name of the Vulnerable Software and Affected Versions: Webkul QloApps version 1.6.1 Description: A problematic issue was found in Webkul QloApps, affecting the logout function of the "/en/?mylogout" endpoint in the URL Handler component. This issue leads to cross-site request forgery and can be...
Webkul QloApps 安全漏洞
Webkul QloApps is a hotel reservation management software from Webkul. A security vulnerability exists in Webkul QloApps version 1.6.1, which stems from a cross-site request forgery attack due to a logout feature in the file /en/?mylogout of the component URL Handler...
CVE-2024-40318
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file...
Webkul QloApps 安全漏洞
Webkul QloApps is a hotel reservation management software from Webkul Inc. A security vulnerability exists in Webkul QloApps version 1.6.0.0, which originates from an arbitrary file upload vulnerability. An attacker can exploit this vulnerability to execute arbitrary code by uploading a specially...
CVE-2024-40318
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file...
CVE-2024-40318
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file...
PT-2024-28804 · Webkul · Webkul Qloapps
Name of the Vulnerable Software and Affected Versions: Webkul Qloapps version 1.6.0.0 Description: The issue allows attackers to execute arbitrary code via uploading a crafted file, due to an arbitrary file upload vulnerability. Recommendations: For Webkul Qloapps version 1.6.0.0, update to a...
CVE-2024-40318
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file...
CVE-2024-40318
CVE-2024-40318 is an arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 that enables remote code execution. The root cause involves bypassing file upload restrictions via crafted uploads, with the Red Hat/NVD OSV entries and PT Security notes corroborating a code-execution outcome. Im...
CVE-2023-36235
An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the idorder parameter...
Information disclosure
An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the idorder parameter...
CVE-2023-36235
An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the idorder parameter...
CVE-2023-36235
An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the idorder parameter...
CVE-2023-36235
An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the idorder parameter...
Webkul QloApps Security Breach
Webkul QloApps is free open source hotel booking and online reservation system. A security vulnerability exists in Webkul QloApps versions prior to v1.6.0, which stems from a vulnerability that allows an attacker to obtain sensitive information via the idorder parameter...
CVE-2023-36235
CVE-2023-36235 affects Webkul Qloapps prior to version 1.6.0 , exposing sensitive information via the id_order parameter. The available connected document details indicate an information disclosure risk rooted in handling of the id_order input, enabling an attacker to obtain sensitive data. The v...
PT-2024-12549 · Webkul · Webkul Qloapps
Name of the Vulnerable Software and Affected Versions: webkul qloapps versions prior to 1.6.0 Description: An issue in webkul qloapps allows an attacker to obtain sensitive information via the id order parameter. Recommendations: For versions prior to 1.6.0, update to version 1.6.0 or later to...
CVE-2023-36287
An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter...
CVE-2023-36287
An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter...