Skip to content
Webkul vulnerabilities
Newest
-
webkul bagisto
Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload
CVE-2026-121733
2.1 Low
-
qloapps
QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview
CVE-2026-116746
6.9 Medium
-
qloapps
QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation
CVE-2026-116745
6.9 Medium
-
webkul qloapps
QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
CVE-2026-115326
5.3 Medium
-
webkul aureus erp
Webkul Aureus ERP UserForm.php weak password
CVE-2026-112193
6.3 Medium
-
webkul aureus erp
Webkul Aureus ERP composer.json insertion of sensitive information into debugging code
CVE-2026-112190
6.9 Medium
-
webkul aureus erp
Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
CVE-2026-111284
5.1 Medium
-
webkul qloapps
QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips
CVE-2026-110229
5.3 Medium
-
webkul qloapps
QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation
CVE-2026-110226
5.3 Medium
-
webkul qloapps
QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors
CVE-2026-110224
5.1 Medium
-
webkul qloapps
QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value
CVE-2026-110221
5.1 Medium
-
webkul qloapps
QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field
CVE-2026-110219
5.1 Medium
-
webkul aureus erp
Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL
CVE-2026-110218
6.3 Medium
-
webkul qloapps
QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers
CVE-2026-109393
5.3 Medium
-
webkul qloapps
QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking
CVE-2026-107702
5.3 Medium
-
webkul qloapps
QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms
CVE-2026-105836
5.3 Medium
-
webkul qloapps
QloApps through 1.7.0 Reflected XSS via Length of Stay Fields
CVE-2026-103590
5.1 Medium
-
webkul qloapps
QloApps through 1.7.0 Reflected XSS via Room Type Editor
CVE-2026-103589
5.1 Medium
-
webkul qloapps
QloApps through 1.7.0 Reflected XSS via exceptions field
CVE-2026-103588
5.1 Medium
-
webkul qloapps
QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters
CVE-2026-103587
5.1 Medium
-
webkul bagisto
Webkul Bagisto Invoice Mass Status Update state authorization
CVE-2026-101139
5.1 Medium
-
webkul aureus erp
Aureus ERP 1.6.0 Stored XSS via SVG File Upload
CVE-2026-97062
5.1 Medium
-
webkul aureus erp
Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
CVE-2026-95655
8.6 High
-
webkul aureus erp
Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log
CVE-2026-94387
5.1 Medium
-
webkul qloapps
QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
CVE-2026-93988
7.1 High
-
webkul aureus erp
Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
CVE-2026-93454
5.1 Medium
-
webkul qloapps
QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors
CVE-2026-92234
5.1 Medium
-
webkul qloapps
QloApps through 1.7.0 Reflected XSS via List Filter Parameters
CVE-2026-89268
5.1 Medium
-
webkul qloapps
Webkul QloApps SQL injection
CVE-2026-75498
8.6 High
-
webkul qloapps
Webkul QloApps SQL injection
CVE-2026-75497
8.6 High
-
webkul qloapps
Webkul QloApps improper file upload validation
CVE-2026-75496
8.6 High
-
webkul bagisto
Webkul Bagisto Customer-Registration Notification Email register cross site scripting
CVE-2026-75082
5.3 Medium
-
webkul bagisto
Webkul Bagisto store behavioral workflow
CVE-2026-75081
5.3 Medium
-
webkul bagisto
Webkul Bagisto Backend Sales RMA Endpoint requests authorization
CVE-2026-19997
5.1 Medium
-
webkul bagisto
Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management
CVE-2026-19996
5.3 Medium
-
webkul bagisto
Webkul Bagisto RMA Message send-message cross site scripting
CVE-2026-19995
5.1 Medium
-
webkul bagisto
Webkul Bagisto Configuration Management execute authorization
CVE-2026-19994
5.3 Medium
-
webkul bagisto
Webkul Bagisto RMA State Validation update-status behavioral workflow
CVE-2026-19993
5.3 Medium
-
webkul bagisto
Webkul Bagisto Backend Reporting Endpoint sales authorization
CVE-2026-19838
5.3 Medium
-
webkul bagisto
Webkul Bagisto Customer Search search information disclosure
CVE-2026-19837
5.1 Medium
-
webkul bagisto
Webkul Bagisto Backend Customer Detail Feature view authorization
CVE-2026-19836
5.3 Medium
-
webkul bagisto
Webkul Bagisto Customer Item Deletion Endpoint access control
CVE-2026-19835
5.1 Medium
-
webkul bagisto
Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization
CVE-2026-19834
5.1 Medium
-
webkul bagisto
Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php
CVE-2026-60120
5.1 Medium
-
webkul ajax quiz
Joomla! Component Ajax Quiz 1.8 SQL Injection
CVE-2017-20262
8.8 High
-
qloapps
QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager
CVE-2026-25558
4.8 Medium
-
webkul bagisto
Path Traversal Vulnerability in Bagisto
CVE-2026-9506
8.7 High
-
qloapps
QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php
CVE-2026-25861
8.2 High
-
webkul krayin crm
Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php
CVE-2026-38532
8.1 High
-
webkul krayin crm
Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php
CVE-2026-38530
8.1 High
- Show olderLoading…