Log in Start free

Webkul

Products

ProductCVEsExploitedLatest
QloApps23–Oct 22, 2026
Bagisto16–Nov 3, 2026
Aureus ERP8–Oct 19, 2026
Krayin CRM2–Apr 14, 2025
Medical Prescription Attachment Plugin for WooCommerce1–Jul 16, 2025
WooCommerce Point of Sale1–Dec 25, 2024

Exploited and recent CVEs

  • CVE-2026-121733 Medium 5.4 Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload 0.2%
  • CVE-2026-115326 Medium 5.4 QloApps through 1.7.0 IDOR via OrderDetailController Refund Request 0.2%
  • CVE-2026-112193 Low 3.7 Webkul Aureus ERP UserForm.php weak password 0.5%
  • CVE-2026-112190 Medium 5.3 Webkul Aureus ERP composer.json insertion of sensitive information into debugging code 0.3%
  • CVE-2026-111284 Medium 5.4 Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal 0.2%
  • CVE-2026-110229 Medium 5.4 QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips 0.3%
  • CVE-2026-110226 Medium 5.4 QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation 0.3%
  • CVE-2026-110224 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors 0.3%
  • CVE-2026-110221 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value 0.2%
  • CVE-2026-110219 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field 0.3%
  • CVE-2026-110218 Low 3.7 Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL 0.4%
  • CVE-2026-109393 Medium 6.3 QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers 0.2%
  • CVE-2026-107702 Medium 4.3 QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking 0.3%
  • CVE-2026-105836 Medium 5.4 QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms 0.3%
  • CVE-2026-103590 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Length of Stay Fields 0.2%
  • CVE-2026-103589 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Room Type Editor 0.2%
  • CVE-2026-103588 Medium 5.4 QloApps through 1.7.0 Reflected XSS via exceptions field 0.2%
  • CVE-2026-103587 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters 0.2%
  • CVE-2026-101139 Low 2.7 Webkul Bagisto Invoice Mass Status Update state authorization 0.3%
  • CVE-2026-97062 Medium 5.4 Aureus ERP 1.6.0 Stored XSS via SVG File Upload 0.2%
  • CVE-2026-95655 High 8.1 Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel 0.5%
  • CVE-2026-94387 Medium 5.4 Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log 0.3%
  • CVE-2026-93988 Medium 6.5 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML 0.6%
  • CVE-2026-93454 Medium 5.4 Aureus ERP through 1.6.0 Stored XSS via Payment Term Note 0.3%
  • CVE-2026-92234 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors 0.3%
  • CVE-2026-89268 Medium 5.4 QloApps through 1.7.0 Reflected XSS via List Filter Parameters 0.3%
  • CVE-2026-75498 High 7.2 Webkul QloApps SQL injection 0.8%
  • CVE-2026-75497 High 7.2 Webkul QloApps SQL injection 0.8%
  • CVE-2026-75496 High 7.2 Webkul QloApps improper file upload validation 1.0%
  • CVE-2026-75082 Medium 4.3 Webkul Bagisto Customer-Registration Notification Email register cross site scripting 0.4%