CVE-2023-30256

CVE-2023-30256 affects Webkul Webkil/QloApps v1.5.2. The issue is a Cross‑Site Scripting (XSS) vulnerability in the AuthController.php handling the two parameters, back and email_create , which can be exploited by remote attackers to obtain sensitive information and potentially execute script in ...

CVE-2025-26058

Webkul QloApps v1.6.1 is vulnerable to the exposure of authentication tokens in URLs during redirection. When users access protected areas, such as the admin panel, the application appends sensitive tokens directly to the URL string (CWE-598). An attacker could potentially obtain these tokens to ...

CVE-2025-1074

Webkul QloApps 1.6.1 is affected by a cross-site request forgery in the URL Handler logout function at /en/?mylogout. The vulnerability stems from the logout endpoint logic, enabling remote CSRF exploitation. Public exploit/disclosures exist and the vendor has been informed and is working on a fi...

CVE-2025-1155

CVE-2025-1155 affects Webkul QloApps 1.6.1, specifically the Your Location Search component in the /stores path. Reported vulnerability is a cross-site scripting (XSS) issue generated by manipulating input in an unknown part of the stores file. It is exploitable remotely according to the sources....

CVE-2023-36289

Webkul QloApps 1.6.0 is affected by an unauthenticated Cross-Site Scripting (XSS) vulnerability that allows an attacker to obtain a user’s session cookie and impersonate the user via POST email_create and back parameter. Impact: potential session hijacking and user impersonation. Remediation: app...

CVE-2024-40318

CVE-2024-40318 is an arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 that enables remote code execution. The root cause involves bypassing file upload restrictions via crafted uploads, with the Red Hat/NVD OSV entries and PT Security notes corroborating a code-execution outcome. Im...

CVE-2023-36287

Webkul QloApps 1.6.0 is affected by an unauthenticated Cross‑Site Scripting (XSS) vulnerability. The issue enables an attacker to exfiltrate a user’s session cookie and impersonate the user via a POST controller parameter. Evidence appears in the Nuclei template for CVE-2023-36287 and mirrors oth...

CVE-2023-36284

Webkul QloApps 1.6.0 contains an unauthenticated Time-Based SQL injection via GET parameters date_from, date_to, and id_product. The underlying flaw allows an attacker to bypass authentication/authorization and retrieve the database contents. The issue is documented across multiple feeds (NVD, NV...

CVE-2023-36288

The CVE-2023-36288 issue affects Webkul QloApps v1.6.0 and is an unauthenticated Cross-Site Scripting (XSS) flaw in the configure parameter of a GET request. The underlying risk is that an attacker can steal a user’s session cookie and impersonate that user. There is no explicit evidence of explo...

CVE-2025-6173

Webkul QloApps 1.6.1 is affected by a SQL injection in /admin/ajax_products_list.php via manipulation of the packItself parameter. The vulnerability is exploitable remotely; exploitation details have been disclosed publicly. The vendor notes admin-privilege prerequisites and a fix is planned for ...

CVE-2023-36235

CVE-2023-36235 affects Webkul Qloapps prior to version 1.6.0 , exposing sensitive information via the id_order parameter. The available connected document details indicate an information disclosure risk rooted in handling of the id_order input, enabling an attacker to obtain sensitive data. The v...

CVE-2025-10759

Webkul QloApps up to 1.7.0 is affected by a CSRF Token Handler vulnerability. Manipulating the token argument can bypass authorization, potentially enabling remote abuse. The exploit is public. Vendor states a fix will be implemented in the next major release; no specific patched version is provi...

CVE-2025-67325

QloApps versions 1.7.0 and earlier are vulnerable to unrestricted file upload within the hotel review feature, specifically at the /module/qlohotelreview/default endpoint. The root cause is a lack of file extension validation, allowing uploaded files to be executed directly by the server without ...

CVE-2021-41074

A Cross-Site Request Forgery (CSRF) vulnerability exists in the index.php file of QloApps hotel eCommerce version 1.5.1 . An attacker can exploit this issue by tricking an administrator into interacting with a crafted HTML document , which could result in the unauthorized modification of the admi...