Login Request a demo
WE
Vendor
Webkul
11 products with CVEs on record
99
CVEs
0
On KEV
18
New 30D
Products
QL
qloapps
webkul
9.8
33 CVEs0 on KEV13 new
AE
Aureus ERP
Webkul
8.1
8 CVEs0 on KEV4 new
BA
Bagisto
Webkul
9.8
36 CVEs0 on KEV1 new
KC
Krayin Crm
Webkul
9.6
8 CVEs0 on KEV0 new
UN
Unopim
Webkul
8.8
7 CVEs0 on KEV0 new
UV
Uvdesk
Webkul
7.8
2 CVEs0 on KEV0 new
AQ
Ajax Quiz
Webkul
8.2
1 CVEs0 on KEV0 new
BP
Bundle Product
Webkul
9.8
1 CVEs0 on KEV0 new
CU
Com Ultimateportfolio
Webkul
–
1 CVEs0 on KEV0 new
KR
Krayin
Webkul
6.1
1 CVEs0 on KEV0 new
WP
WooCommerce Point of Sale
Webkul
9.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-115326
New
QL
QloApps
Webkul
5.4
0%
Oct 22QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
CVE-2026-112193
AE
Aureus ERP
Webkul
3.7
0%
Oct 19Webkul Aureus ERP UserForm.php weak password
CVE-2026-112190
AE
Aureus ERP
Webkul
5.3
0%
Oct 19Webkul Aureus ERP composer.json insertion of sensitive information into debugging code
CVE-2026-111284
AE
Aureus ERP
Webkul
5.4
0%
Oct 15Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
CVE-2026-110229
QL
QloApps
Webkul
5.4
0%
Oct 13QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips
CVE-2026-110226
QL
QloApps
Webkul
5.4
0%
Oct 13QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation
CVE-2026-110224
QL
QloApps
Webkul
5.4
0%
Oct 13QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors
CVE-2026-110221
QL
QloApps
Webkul
5.4
0%
Oct 13QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value
CVE-2026-110219
QL
QloApps
Webkul
5.4
0%
Oct 13QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field
CVE-2026-110218
AE
Aureus ERP
Webkul
3.7
0%
Oct 13Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL
CVE-2026-109393
QL
QloApps
Webkul
6.3
0%
Oct 12QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers
CVE-2026-107702
QL
QloApps
Webkul
4.3
0%
Oct 8QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking
CVE-2026-105836
QL
QloApps
Webkul
5.4
0%
Oct 6QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms
CVE-2026-103590
QL
QloApps
Webkul
5.4
0%
Sep 30QloApps through 1.7.0 Reflected XSS via Length of Stay Fields
CVE-2026-103589
QL
QloApps
Webkul
5.4
0%
Sep 30QloApps through 1.7.0 Reflected XSS via Room Type Editor
CVE-2026-103588
QL
QloApps
Webkul
5.4
0%
Sep 30QloApps through 1.7.0 Reflected XSS via exceptions field
CVE-2026-103587
QL
QloApps
Webkul
5.4
0%
Sep 30QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters
CVE-2026-101139
BA
Bagisto
Webkul
2.7
0%
Sep 28Webkul Bagisto Invoice Mass Status Update state authorization
CVE-2026-97062
AE
Aureus ERP
Webkul
5.4
0%
Sep 24Aureus ERP 1.6.0 Stored XSS via SVG File Upload
CVE-2026-95655
AE
Aureus ERP
Webkul
8.1
0%
Sep 22Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
CVE-2026-94387
AE
Aureus ERP
Webkul
5.4
0%
Sep 21Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log
CVE-2026-93988
QL
qloapps
webkul
6.5
1%
Sep 19QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
CVE-2026-93454
AE
Aureus ERP
Webkul
5.4
0%
Sep 17Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
CVE-2026-92234
QL
QloApps
Webkul
5.4
0%
Sep 15QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors
CVE-2026-89268
QL
QloApps
Webkul
5.4
0%
Sep 12QloApps through 1.7.0 Reflected XSS via List Filter Parameters
CVE-2026-75498
QL
QloApps
Webkul
7.2
1%
Aug 25Webkul QloApps SQL injection
CVE-2026-75497
QL
QloApps
Webkul
7.2
1%
Aug 25Webkul QloApps SQL injection
CVE-2026-75496
QL
QloApps
Webkul
7.2
1%
Aug 25Webkul QloApps improper file upload validation
CVE-2026-75082
BA
Bagisto
Webkul
4.3
0%
Aug 18Webkul Bagisto Customer-Registration Notification Email register cross site scripting
CVE-2026-75081
BA
Bagisto
Webkul
4.3
0%
Aug 17Webkul Bagisto store behavioral workflow
CVE-2026-19997
BA
Bagisto
Webkul
4.7
0%
Aug 17Webkul Bagisto Backend Sales RMA Endpoint requests authorization
CVE-2026-19996
BA
Bagisto
Webkul
4.3
0%
Aug 17Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management
CVE-2026-19995
BA
Bagisto
Webkul
3.5
0%
Aug 17Webkul Bagisto RMA Message send-message cross site scripting
CVE-2026-19994
BA
Bagisto
Webkul
6.3
0%
Aug 17Webkul Bagisto Configuration Management execute authorization
CVE-2026-19993
BA
Bagisto
Webkul
4.3
0%
Aug 17Webkul Bagisto RMA State Validation update-status behavioral workflow
CVE-2026-19838
BA
Bagisto
Webkul
4.3
0%
Aug 14Webkul Bagisto Backend Reporting Endpoint sales authorization
CVE-2026-19837
BA
Bagisto
Webkul
2.7
0%
Aug 14Webkul Bagisto Customer Search search information disclosure
CVE-2026-19836
BA
Bagisto
Webkul
4.3
0%
Aug 14Webkul Bagisto Backend Customer Detail Feature view authorization
CVE-2026-19835
BA
Bagisto
Webkul
3.8
0%
Aug 14Webkul Bagisto Customer Item Deletion Endpoint access control
CVE-2026-19834
BA
Bagisto
Webkul
4.7
0%
Aug 14Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization
CVE-2026-60120
BA
Bagisto
Webkul
5.4
0%
Jul 9Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php
CVE-2017-20262
AQ
Ajax Quiz
Webkul
8.2
0%
Jun 19Joomla! Component Ajax Quiz 1.8 SQL Injection
CVE-2026-9506
BA
Bagisto
Webkul
8.7
1%
Jun 8Path Traversal Vulnerability in Bagisto
CVE-2026-38532
KC
Krayin Crm
Webkul
8.1
0%
Apr 14A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read,…
CVE-2026-38530
KC
Krayin Crm
Webkul
8.1
0%
Apr 14A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read,…
CVE-2026-38529
KC
Krayin Crm
Webkul
8.8
1%
Apr 14A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user…
CVE-2021-41074
QL
Qloapps
Webkul
5.4
0%
Jan 12A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document
CVE-2025-67325
QL
Qloapps
Webkul
9.8
1%
Jan 8Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution
CVE-2026-21451
BA
Bagisto
Webkul
8.4
1%
Jan 2Bagisto is an open source laravel eCommerce platform
CVE-2026-21450
BA
Bagisto
Webkul
9.8
1%
Jan 2Bagisto is an open source laravel eCommerce platform
CVE-2026-21449
BA
Bagisto
Webkul
8.8
1%
Jan 2Bagisto is an open source laravel eCommerce platform
CVE-2026-21448
BA
Bagisto
Webkul
9.8
1%
Jan 2Bagisto is an open source laravel eCommerce platform
CVE-2026-21447
BA
Bagisto
Webkul
7.1
0%
Jan 2Bagisto is an open source laravel eCommerce platform
CVE-2026-21446
BA
Bagisto
Webkul
9.8
1%
Jan 2Bagisto is an open source laravel eCommerce platform
CVE-2025-62418
BA
Bagisto
Webkul
4.8
0%
Oct 16Bagisto is an open source laravel eCommerce platform
CVE-2025-62417
BA
Bagisto
Webkul
7.8
0%
Oct 16Bagisto is an open source laravel eCommerce platform
CVE-2025-62416
BA
Bagisto
Webkul
6.8
0%
Oct 16Bagisto is an open source laravel eCommerce platform
CVE-2025-62415
BA
Bagisto
Webkul
4.8
0%
Oct 16Bagisto is an open source laravel eCommerce platform
CVE-2025-62414
BA
Bagisto
Webkul
4.8
0%
Oct 16Bagisto is an open source laravel eCommerce platform
CVE-2025-60880
BA
Bagisto
Webkul
8.3
0%
Oct 10An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious…