Webkul Qloapps

QloApps 1.7.0 Path Traversal via admin/ajax.php getEmailHTML
CVE-2026-93988 7.1 - High - September 19, 2026

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.

Directory traversal

QloApps 1.7.0 XSS via child_features in back-office
CVE-2026-92234 5.1 - Medium - September 15, 2026

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.

XSS

QloApps <=1.7.0 XSS via list helper POST filter unescaped
CVE-2026-89268 5.1 - Medium - September 12, 2026

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.

XSS

SQLi in Webkul QloApps Address.php via bo_query param
CVE-2026-75498 7.2 - High - August 25, 2026

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c.

SQL Injection

SQL Injection in Webkul QloApps via unsanitized bo_query param (CustomerMessage.php)
CVE-2026-75497 7.2 - High - August 25, 2026

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.

SQL Injection

QloApps: Inadequate File Extension/MIME Validation Leads to RCE
CVE-2026-75496 7.2 - High - August 25, 2026

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.

Unrestricted File Upload

QloApps <1.7.0 XSS via SVG in admin file manager
CVE-2026-25558 4.8 - Medium - June 08, 2026

QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded through the file manager to execute arbitrary scripts in the browser of any user who subsequently views the file.

XSS

QloApps 1.7.0 MD5 Hashing Vulnerability in Tools::encrypt()
CVE-2026-25861 5.9 - Medium - June 02, 2026

QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.

Use of Password Hash With Insufficient Computational Effort

Webkul QloApps <1.7.0 CSRF Token Handler Auth Bypass
CVE-2025-10759 5.3 - Medium - September 21, 2025

A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of the argument token results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. The vendor explains: "As We are already aware about this vulnerability and our Internal team are already working on this issue. (...) We'll implement the fix for this vulnerability in our next major release."

Insecure Direct Object Reference / IDOR

SQLi in Webkul QloApps 1.6.1 admin/ajax_products_list.php
CVE-2025-6173 7.2 - High - June 17, 2025

A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_products_list.php. The manipulation of the argument packItself leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this flaw but considers it a low-level issue due to admin privilege pre-requisites. Still, a fix is planned for a future release.

SQL Injection

Webkul QloApps 1.6.1 Auth Token Exposure via URL Redirection
CVE-2025-26058 - February 18, 2025

Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application appends sensitive authentication tokens directly to the URL.

Webkul QloApps 1.6.1 XSS in Your Location Search (stores)
CVE-2025-1155 6.1 - Medium - February 10, 2025

A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the component Your Location Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. It is planned to remove this page in the long term.

XSS

Webkul QloApps 1.6.1 CSRF via logout URL Handler
CVE-2025-1074 4.3 - Medium - February 06, 2025

A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the component URL Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. They are aware about it and are working on resolving it.

Session Riding

QloApps 1.6.0.0: Arbitrary File Upload (CVE-2024-40318)
CVE-2024-40318 7.2 - High - July 25, 2024

An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file.

Unrestricted File Upload

Webkul QloApps <1.6.0 Sensitive Order ID Disclosure
CVE-2023-36235 6.5 - Medium - January 17, 2024

An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter.

Insecure Direct Object Reference / IDOR

Webkul QloApps 1.6.0: TimeBased SQLi via GET(date_from, date_to, id_product) auth bypass
CVE-2023-36284 7.5 - High - June 23, 2023

An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication and authorization mechanisms and retrieve the contents of an entire database.

SQL Injection

XSS in Webkul QloApps 1.6.0 via POST controller param
CVE-2023-36287 6.1 - Medium - June 23, 2023

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.

XSS

Unauth XSS via GET 'configure' in Webkul QloApps 1.6.0
CVE-2023-36288 5.4 - Medium - June 23, 2023

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter.

XSS

Unauthenticated XSS in Webkul QloApps 1.6.0 via POST email_create 'back' param
CVE-2023-36289 6.1 - Medium - June 23, 2023

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and back parameter.

XSS

XSS in Webkil QloApps v1.5.2 via back/email_create in AuthController.php
CVE-2023-30256 6.1 - Medium - May 11, 2023

Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file.

XSS