EUVD-2026-110494

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed reviewajaxtoken and enumerate sequential idorder...

CVE-2026-116746

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed reviewajaxtoken and enumerate sequential idorder...

CVE-2026-116746

The QloApps platform (versions 1.6.0 through 1.7.0 ) contains a missing authorization vulnerability within the qlohotelreview module's AddReview AJAX action . This flaw allows unauthenticated attackers to submit fake ratings and reviews for arbitrary orders. The attack vector involves reusing a p...

CVE-2026-116746 QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed reviewajaxtoken and enumerate sequential idorder...

EUVD-2008-3566

Malware in sbrugna...

Sql injection

Multiple SQL injection vulnerabilities in Qsoft K-Links allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to visit.php, or the PATHINFO to the default URI under 2 report/, 3 addreview/, or 4 refer/...

CVE-2008-3580: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Qsoft K-Links allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to visit.php, or the PATHINFO to the default URI under 2 report/, 3 addreview/, or 4 refer/...