CVE-2023-30256

Webkul Qloapps 1.5.2 - Cross-Site Scripting XSS Webkul QloApps 1.5.2: Vulnerable to XSS on two Parameter emailcreate and back Exploit - Proof of Concept POC XXS: 'back' Parameter Payload Parameter back – Plain text: xss onfocus=alert1 autofocus= xss Payload Parameter back – URL Encoded:...

QloApps 1.6.0 - SQL Injection

An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameters datefrom, dateto, and idproduct allows a remote attacker to retrieve the contents of an entire database. id: CVE-2023-36284 info: name: QloApps 1.6.0 - SQL Injection author: ritikchaddha severity: high...

Webkul QloApps 1.6.0 - Cross-site Scripting

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST emailcreate and back parameter. id: CVE-2023-36289 info: name: Webkul QloApps 1.6.0 - Cross-site Scripting author:...

Webkul QloApps 1.6.0 - Cross-site Scripting

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter. id: CVE-2023-36287 info: name: Webkul QloApps 1.6.0 - Cross-site Scripting author: theamanrawa...

CVE-2021-41074

CVE-2021-41074 Qloapps HotelCommerce 1.5.1의 CSRF HotelCommerce 1.5.1에는 CSRF가 존재합니다. 이로 인해 누구나 관리자 이메일을 변경할 수 있습니다. 공격자가 관리자로 하여금 악의적으로 조작된 HTML 문서를 클릭하도록 유도하면, 관리자 사용자 이메일을 변경할 수 있습니다...

CVE-2025-67325

🚨 파일 업로드를 통한 인증되지 않은 원격 코드 실행 RCE 📌 개요 프로젝트: QloApps 저장소: https://github.com/Qloapps/QloApps 영향을 받는 버전: = 1.7.0 취약점 종류: 인증되지 않은 원격 코드 실행 심각도: 치명적 CVSS v3.1: 치명적 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE ID: CVE-2025-67325 발견자: Neakk Pornlur 공개일: 2026-01-09 🧩 설명 QloApps 1.7.0 및 이전 버전의 호...

Webkul QloApps 1.5.2 - Cross-site Scripting

Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and emailcreate parameters in the AuthController.php file. id: CVE-2023-30256 info: name: Webkul QloApps 1.5.2 - Cross-site Scripting author: theamanrawat...

RCE-QloApps-CVE-2024-40318

RCE-QloApps-CVE-2024-40318 원격 코드 실행RCE 공격은 공격자가 컴퓨터에서 코드를 실행할 수 있게 합니다. 코드 실행 능력은 추가 악성코드 배포, 민감한 데이터 도난, 심지어 서버 손상으로 이어질 수 있습니다. 원격 코드 실행은 Qloapps 버전 1.6.0.0에서 발견되었으며, 애플리케이션이 관리자 패널의 "모듈 및 서비스" 섹션에서 검사되던 중 발견되었습니다. 이 섹션에서는...

EUVD-2026-90437

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

EUVD-2026-90438

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

EUVD-2026-90435

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

EUVD-2026-90436

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

CVE-2026-103590

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103589

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-103587

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

CVE-2026-103588

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

CVE-2026-103590 QloApps through 1.7.0 Reflected XSS via Length of Stay Fields

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103590 QloApps through 1.7.0 Reflected XSS via Length of Stay Fields

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103590 QloApps through 1.7.0 Reflected XSS via Length of Stay Fields

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103590

QloApps versions through 1.7.0 are affected by a reflected cross-site scripting (XSS) vulnerability within the back-office room type editor. The flaw exists in the length of stay fields , where an attacker can craft POST requests containing malicious payloads in the restriction_min_los and restri...