Webkul Qloapps vulnerabilities

• qloapps QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview CVE-2026-116746 6.9 MediumOctober 26, 2026
• qloapps QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation CVE-2026-116745 6.9 MediumOctober 26, 2026
• webkul qloapps QloApps through 1.7.0 IDOR via OrderDetailController Refund Request CVE-2026-115326 5.3 MediumOctober 22, 2026
• webkul qloapps QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips CVE-2026-110229 5.3 MediumOctober 13, 2026
• webkul qloapps QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation CVE-2026-110226 5.3 MediumOctober 13, 2026
• webkul qloapps QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors CVE-2026-110224 5.1 MediumOctober 13, 2026
• webkul qloapps QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value CVE-2026-110221 5.1 MediumOctober 13, 2026
• webkul qloapps QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field CVE-2026-110219 5.1 MediumOctober 13, 2026
• webkul qloapps QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers CVE-2026-109393 5.3 MediumOctober 12, 2026
• webkul qloapps QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking CVE-2026-107702 5.3 MediumOctober 8, 2026
• webkul qloapps QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms CVE-2026-105836 5.3 MediumOctober 6, 2026
• webkul qloapps QloApps through 1.7.0 Reflected XSS via Length of Stay Fields CVE-2026-103590 5.1 MediumSeptember 30, 2026
• webkul qloapps QloApps through 1.7.0 Reflected XSS via Room Type Editor CVE-2026-103589 5.1 MediumSeptember 30, 2026
• webkul qloapps QloApps through 1.7.0 Reflected XSS via exceptions field CVE-2026-103588 5.1 MediumSeptember 30, 2026
• webkul qloapps QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters CVE-2026-103587 5.1 MediumSeptember 30, 2026
• webkul qloapps QloApps through 1.7.0 Arbitrary File Read via getEmailHTML CVE-2026-93988 7.1 HighSeptember 19, 2026
• webkul qloapps QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors CVE-2026-92234 5.1 MediumSeptember 15, 2026
• webkul qloapps QloApps through 1.7.0 Reflected XSS via List Filter Parameters CVE-2026-89268 5.1 MediumSeptember 12, 2026
• webkul qloapps Webkul QloApps SQL injection CVE-2026-75498 8.6 HighAugust 25, 2026
• webkul qloapps Webkul QloApps SQL injection CVE-2026-75497 8.6 HighAugust 25, 2026
• webkul qloapps Webkul QloApps improper file upload validation CVE-2026-75496 8.6 HighAugust 25, 2026
• qloapps QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager CVE-2026-25558 4.8 MediumJune 8, 2026
• qloapps QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php CVE-2026-25861 8.2 HighJune 2, 2026
• webkul qloapps A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin... CVE-2021-41074 Public exploit 5.4 MediumJanuary 12, 2026
• webkul qloapps Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows... CVE-2025-67325 Public exploit 9.8 CriticalJanuary 8, 2026
• webkul qloapps Webkul QloApps CSRF Token authorization CVE-2025-10759 6.9 MediumSeptember 21, 2025
• webkul qloapps Webkul QloApps ajax_products_list.php sql injection CVE-2025-6173 5.1 MediumJune 17, 2025
• webkul qloapps Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access... CVE-2025-26058 4.2 MediumFebruary 18, 2025
• webkul qloapps Webkul QloApps Your Location Search stores cross site scripting CVE-2025-1155 5.3 MediumFebruary 10, 2025
• webkul qloapps Webkul QloApps URL mylogout cross-site request forgery CVE-2025-1074 5.3 MediumFebruary 6, 2025
• webkul qloapps An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute... CVE-2024-40318 Public exploit 7.2 HighJuly 25, 2024
• webkul qloapps An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via... CVE-2023-36235 6.5 MediumJanuary 17, 2024
• webkul qloapps An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows... CVE-2023-36289 6.1 MediumJune 23, 2023
• webkul qloapps An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows... CVE-2023-36288 5.4 MediumJune 23, 2023
• webkul qloapps An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows... CVE-2023-36287 6.1 MediumJune 23, 2023
• webkul qloapps An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter... CVE-2023-36284 7.5 HighJune 23, 2023
• webkul qloapps Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to... CVE-2023-30256 Public exploit 6.1 MediumMay 11, 2023