Webkul QloApps vulnerabilities
23 published CVEs name Webkul QloApps among the affected products.
- 23Published CVEs23 of them scored
- 19Last 12 monthspublished in the last year
- 0Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-115326
QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
Webkul · QloApps
Medium5.3 - CVE-2026-110229
QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips
Webkul · QloApps
Medium5.3 - CVE-2026-110226
QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation
Webkul · QloApps
Medium5.3 - CVE-2026-110224
QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors
Webkul · QloApps
Medium5.1 - CVE-2026-110221
QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value
Webkul · QloApps
Medium5.1 - CVE-2026-110219
QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field
Webkul · QloApps
Medium5.1 - CVE-2026-109393
QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers
Webkul · QloApps
Medium5.3 - CVE-2026-107702
QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking
Webkul · QloApps
Medium5.3 - CVE-2026-105836
QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms
Webkul · QloApps
Medium5.3 - CVE-2026-103590
QloApps through 1.7.0 Reflected XSS via Length of Stay Fields
Webkul · QloApps
Medium5.1