Medium severity · published Feb 18, 2025
CVE-2025-26058
Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection
4.2
CVSS
0.2%
EPSS
No
On KEV
Description
Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application appends sensitive authentication tokens directly to the URL.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QL
Qloapps · Webkul
1.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-26058
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-26058
Exploit
https://github.com/mano257200/QloApps-VUL
More from Qloapps
9.8
CVE-2025-67325
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution
7.5
CVE-2023-36284
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web…
7.2
CVE-2026-75498
Webkul QloApps SQL injection
7.2
CVE-2026-75497
Webkul QloApps SQL injection
7.2
CVE-2026-75496
Webkul QloApps improper file upload validation