CVE-2026-38530

A Broken Object-Level Authorization BOLA in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request...

PT-2026-32680

Name of the Vulnerable Software and Affected Versions Krayin CRM versions 2.2.x and earlier Description An authenticated arbitrary file upload flaw exists in the /admin/tinymce/upload endpoint. This issue allows an authenticated attacker to upload a crafted PHP file, such as a web shell, leading ...

CVE-2026-38532

A Broken Object-Level Authorization BOLA in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request...

CVE-2021-41924

Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting XSS...

CVE-2019-16403

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values such as address, review, orders, etc. can also be manipulated by other customers...

CVE-2025-1074

A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the component URL Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-1155

A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the component Your Location Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. It is planned to remove...

Webkul Software Bagisto 安全漏洞

Webkul Software Bagisto is an open source e-commerce framework from Webkul Software India. A security vulnerability exists in Webkul Software Bagisto versions prior to 2.3.10, which stems from server-side template injection and could lead to remote code execution...

CVE-2025-56426

An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logic fails to validate quantity inputs properly...

EUVD-2025-33354

An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logic fails to validate quantity inputs properly...

CVE-2025-56426

Summary: CVE-2025-56426 affects WebKul Bagisto v2.3.6. The issue resides in the Cart/Checkout API’s price calculation logic, where quantity inputs are not properly validated, enabling remote code execution. All sources consistently describe a vulnerability that could be exploited via the Cart/Che...

CVE-2025-56426

An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logic fails to validate quantity inputs properly...

CVE-2025-56426

An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logic fails to validate quantity inputs properly...

EUVD-2019-0761

Malware in sbrugna...

EUVD-2025-1989

Malicious code in bioql PyPI...

EUVD-2023-55932

Malicious code in bioql PyPI...

EUVD-2023-34371

Malicious code in bioql PyPI...

EUVD-2025-10896

Malicious code in bioql PyPI...

EUVD-2025-2030

Malicious code in bioql PyPI...

EUVD-2023-40212

Malicious code in bioql PyPI...