Every CVE whose affected-product data names Webkul Qloapps, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (14)
CVE-2025-67325 — CVSS 9.8 (critical): Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to…
CVE-2023-36284 — CVSS 7.5 (high): An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a…
CVE-2024-40318 — CVSS 7.2 (high): An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2023-36235 — CVSS 6.5 (medium): An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter.
CVE-2023-36287 — CVSS 6.1 (medium): An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session…
CVE-2023-36289 — CVSS 6.1 (medium): An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session…
CVE-2023-30256 — CVSS 6.1 (medium): Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back…
CVE-2023-36288 — CVSS 5.4 (medium): An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session…
CVE-2021-41074 — CVSS 5.4 (medium): A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML…
CVE-2025-10759 — CVSS 5.3 (medium): A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler…
CVE-2025-6173 — CVSS 4.7 (medium): A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the…
CVE-2025-1155 — CVSS 4.3 (medium): A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores…
CVE-2025-1074 — CVSS 4.3 (medium): A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file…
CVE-2025-26058 — CVSS 4.2 (medium): Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas…