Webkul QloApps

• CVE-2026-115326 Medium 5.4 QloApps through 1.7.0 IDOR via OrderDetailController Refund Request 0.2%
• CVE-2026-110229 Medium 5.4 QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips 0.3%
• CVE-2026-110226 Medium 5.4 QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation 0.3%
• CVE-2026-110224 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors 0.3%
• CVE-2026-110221 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value 0.2%
• CVE-2026-110219 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field 0.3%
• CVE-2026-109393 Medium 6.3 QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers 0.2%
• CVE-2026-107702 Medium 4.3 QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking 0.3%
• CVE-2026-105836 Medium 5.4 QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms 0.3%
• CVE-2026-103590 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Length of Stay Fields 0.2%
• CVE-2026-103589 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Room Type Editor 0.2%
• CVE-2026-103588 Medium 5.4 QloApps through 1.7.0 Reflected XSS via exceptions field 0.2%
• CVE-2026-103587 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters 0.2%
• CVE-2026-93988 Medium 6.5 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML 0.6%
• CVE-2026-92234 Medium 5.4 QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors 0.3%
• CVE-2026-89268 Medium 5.4 QloApps through 1.7.0 Reflected XSS via List Filter Parameters 0.3%
• CVE-2026-75498 High 7.2 Webkul QloApps SQL injection 0.8%
• CVE-2026-75497 High 7.2 Webkul QloApps SQL injection 0.8%
• CVE-2026-75496 High 7.2 Webkul QloApps improper file upload validation 1.0%
• CVE-2025-10759 Medium 5.3 Webkul QloApps CSRF Token authorization 0.3%
• CVE-2025-6173 Medium 4.7 Webkul QloApps ajax_products_list.php sql injection 0.6%
• CVE-2025-1155 Medium 4.3 Webkul QloApps Your Location Search stores cross site scripting 0.5%
• CVE-2025-1074 Medium 4.3 Webkul QloApps URL mylogout cross-site request forgery 0.3%