Medium severity · published Sep 21, 2025
CVE-2025-10759
Webkul QloApps CSRF Token authorization
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of the argument token results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. The vendor explains: "As We are already aware about this vulnerability and our Internal team are already working on this issue. (...) We'll implement the fix for this vulnerability in our next major release."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QL
QloApps · Webkul
1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +2 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10759
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10759
Exploit
https://github.com/Ryomensukuna13/QloApps-Reusable-CSRF-Token-in-Logout-Functionality/blob/main/README.md
Exploit
https://github.com/Ryomensukuna13/QloApps-Reusable-CSRF-Token-in-Logout-Functionality/blob/main/README.md#proof-of-concept-poc
Permissions Required
https://vuldb.com/?ctiid.325114
Third Party Advisory
https://vuldb.com/?id.325114
Third Party Advisory
https://vuldb.com/?submit.645821
More from QloApps
9.8
CVE-2025-67325
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution
7.5
CVE-2023-36284
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web…
7.2
CVE-2026-75498
Webkul QloApps SQL injection
7.2
CVE-2026-75497
Webkul QloApps SQL injection
7.2
CVE-2026-75496
Webkul QloApps improper file upload validation