QL
Product
qloapps
33
CVEs
0
On KEV
9.8
Max CVSS
13
New 30D
Severity mix
Critical 1High 6Medium 26Low 0
Watch
Add qloapps to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-67325 | 9.8 | Jan 8 | Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution Affected: through 1.7.0 |
| CVE-2023-36284 | 7.5 | Jun 23 | An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web… Affected: 1.6.0 |
| CVE-2026-75498 | 7.2 | Aug 25 | Webkul QloApps SQL injection Affected: before 123c97c |
| CVE-2026-75497 | 7.2 | Aug 25 | Webkul QloApps SQL injection Affected: before 123c97c |
| CVE-2026-75496 | 7.2 | Aug 25 | Webkul QloApps improper file upload validation Affected: before 153ec1c |
| CVE-2025-6173 | 7.2 | Jun 17 | A vulnerability classified as critical was found in Webkul QloApps 1.6.1 Affected: 1.6.1 |
| CVE-2024-40318 | 7.2 | Jul 25 | An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file Affected: 1.6.0 |
| CVE-2026-93988 | 6.5 | Sep 19 | QloApps through 1.7.0 Arbitrary File Read via getEmailHTML Affected: through 1.7.0 |
| CVE-2023-36235 | 6.5 | Jan 17 | An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter Affected: before 1.6.0 |
| CVE-2026-109393 | 6.3 | Oct 12 | QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers Affected: through 1.7.0 |
| CVE-2025-1155 | 6.1 | Feb 10 | A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1 Affected: 1.6.1 |
| CVE-2023-36287 | 6.1 | Jun 23 | An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via… Affected: 1.6.0 |
| CVE-2023-36289 | 6.1 | Jun 23 | An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via… Affected: 1.6.0 |
| CVE-2023-30256 | 6.1 | May 11 | Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the… Affected: 1.5.2 |
| CVE-2026-115326 New | 5.4 | Oct 22 | QloApps through 1.7.0 IDOR via OrderDetailController Refund Request Affected: through 1.7.0 |
| CVE-2026-110229 | 5.4 | Oct 13 | QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips Affected: through 1.7.0 |
| CVE-2026-110226 | 5.4 | Oct 13 | QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation Affected: through 1.7.0 |
| CVE-2026-110224 | 5.4 | Oct 13 | QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors Affected: through 1.7.0 |
| CVE-2026-110221 | 5.4 | Oct 13 | QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value Affected: through 1.7.0 |
| CVE-2026-110219 | 5.4 | Oct 13 | QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field Affected: through 1.7.0 |
| CVE-2026-105836 | 5.4 | Oct 6 | QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms Affected: through 1.7.0 |
| CVE-2026-103590 | 5.4 | Sep 30 | QloApps through 1.7.0 Reflected XSS via Length of Stay Fields Affected: through 1.7.0 |
| CVE-2026-103589 | 5.4 | Sep 30 | QloApps through 1.7.0 Reflected XSS via Room Type Editor Affected: through 1.7.0 |
| CVE-2026-103588 | 5.4 | Sep 30 | QloApps through 1.7.0 Reflected XSS via exceptions field Affected: through 1.7.0 |
| CVE-2026-103587 | 5.4 | Sep 30 | QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters Affected: through 1.7.0 |
| CVE-2026-92234 | 5.4 | Sep 15 | QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors Affected: through 1.7.0 |
| CVE-2026-89268 | 5.4 | Sep 12 | QloApps through 1.7.0 Reflected XSS via List Filter Parameters Affected: through 1.7.0 |
| CVE-2021-41074 | 5.4 | Jan 12 | A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document Affected: 1.5.1 |
| CVE-2023-36288 | 5.4 | Jun 23 | An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via… Affected: 1.6.0 |
| CVE-2025-10759 | 5.3 | Sep 21 | A vulnerability was detected in Webkul QloApps up to 1.7.0 Affected: through 1.7.0 |
| CVE-2026-107702 | 4.3 | Oct 8 | QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking Affected: through 1.7.0 |
| CVE-2025-1074 | 4.3 | Feb 6 | A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1 Affected: 1.6.1 |
| CVE-2025-26058 | 4.2 | Feb 18 | Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection Affected: 1.6.1 |
Showing 33