Skip to contentWebkul vulnerabilities
Newest
- webkul krayin crmWebkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.phpCVE-2026-385298.8 High
- webkul qloappsA CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin...CVE-2021-41074Public exploit5.4 Medium
- webkul qloappsUnrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows...CVE-2025-67325Public exploit9.8 Critical
- bagistoBagisto has SSTI in parameter that can lead to RCECVE-2026-21450Fix available7.3 High
- bagistoBagisto has HTML Filter Bypass that Enables Stored XSSCVE-2026-21451Fix available5.2 Medium
- bagistoBagisto has SSTI via first and last name from low-privilege user (not admin)CVE-2026-21449Fix available7.4 High
- bagistoBagisto has Normal & Blind SSTI from low-privilege user when ordering productCVE-2026-21448Fix available8.9 High
- bagistoBagisto has IDOR in Customer Order Reorder FunctionalityCVE-2026-21447Fix available7.1 High
- bagistoBagisto Missing Authentication on Installer API EndpointsCVE-2026-21446Fix available8.8 High
- bagistobagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)CVE-2025-62418Fix available6.9 Medium
- bagistobagisto - Cross Site Scripting (XSS) in Create New CustomerCVE-2025-62414Fix available6.9 Medium
- bagistobagisto - Server Side Template Injection (SSTI) in Product DescriptionCVE-2025-62416Fix available5.1 Medium
- bagistobagisto - CSV Formula Injection in Create New ProductCVE-2025-62417Fix available7.1 High
- bagistobagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)CVE-2025-62415Fix available6.9 Medium
- webkul bagistoBagisto is vulnerable to XSS through Admin Panel's product creation pathCVE-2025-60880Public exploitFix available8.3 High
- webkul bagistoAn issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart...CVE-2025-564266.5 Medium
- webkul qloappsWebkul QloApps CSRF Token authorizationCVE-2025-107596.9 Medium
- unopimUnoPim Quick Export feature is vulnerable to CSV injectionCVE-2025-55745Fix available2.5 Low
- unopimunopim/unopim allows unauthorized product deletion via mass-delete endpointCVE-2025-55741Fix available8.1 High
- unopimUnoPim vulnerable to CSRF on Product edit feature and creation of other typesCVE-2025-55744Fix available6.9 Medium
- unopimUnoPim vulnerable to remote code execution through Arbitrary File uploadCVE-2025-55743Fix available7.3 High
- unopimUnoPim Stored XSS via SVG MIME/Sanitizer BypassCVE-2025-55742Fix available8.0 High
- webkul medical prescription attachment plugin for woocommerceWordPress Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Arbitrary File Upload VulnerabilityCVE-2025-29009Public exploit10.0 Critical
- webkul qloappsWebkul QloApps ajax_products_list.php sql injectionCVE-2025-61735.1 Medium
- bagistoReflected Cross-Site Scripting (XSS) in BagistoCVE-2025-406755.1 Medium
- webkul krayin crmWebkul Krayin CRM SVG File edit cross site scriptingCVE-2025-3568Public exploit5.1 Medium
- webkul qloappsWebkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access...CVE-2025-260584.2 Medium
- webkul qloappsWebkul QloApps Your Location Search stores cross site scriptingCVE-2025-11555.3 Medium
- webkul qloappsWebkul QloApps URL mylogout cross-site request forgeryCVE-2025-10745.3 Medium
- webkul woocommerce point of saleWooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email ChangeCVE-2024-112819.8 Critical
- unopimUnoPim Stored XSS : Cookie hijacking through Create User functionCVE-2024-52305Fix available6.5 Medium
- unopimUnoPim Cross-site Scripting vulnerabilityCVE-2024-50637Fix available5.4 Medium
- webkul krayin crmKrayin CRM vulnerable to Cross Site Scripting (XSS) via the organization nameCVE-2024-459324.8 Medium
- webkul krayin crmA Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote...CVE-2024-463679.6 Critical
- webkul krayin crmA Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote...CVE-2024-463668.8 High
- webkul qloappsAn arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute...CVE-2024-40318Public exploit7.2 High
- webkul uvdesk, webkul software uvdesk community +1 moreUnauthenticated Remote Code Execution in UvDesk CommunityCVE-2024-091610.0 Critical
- webkul bagistoBagisto vulnerable to Insecure Direct Object Reference (IDOR)CVE-2023-36238Fix available6.5 Medium
- webkul bagistoBagist Cross-site Scripting vulnerabilityCVE-2024-27499Fix available6.5 Medium
- bagistoBagisto Cross-Site Request Forgery vulnerabilityCVE-2023-36237Fix available8.8 High
- webkul bundle productSQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute...CVE-2023-512109.8 Critical
- webkul qloappsAn issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via...CVE-2023-362356.5 Medium
- webkul bagistoCross-site Scripting in BagistoCVE-2023-36236Fix available4.8 Medium
- webkul uvdeskA stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows...CVE-2023-376365.4 Medium
- webkul uvdeskAn arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code...CVE-2023-39147Public exploit7.8 High
- webkul bagistoBagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).CVE-2023-335708.8 High
- webkul qloappsAn unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows...CVE-2023-362896.1 Medium
- webkul qloappsAn unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows...CVE-2023-362885.4 Medium
- webkul qloappsAn unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows...CVE-2023-362876.1 Medium
- webkul qloappsAn unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter...CVE-2023-362847.5 High
- Show moreLoading…