What’s Vulnerable › Products

Webkul QloApps vulnerabilities

33 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 26 published in the last 12 months.

Check whether your Webkul QloApps version is affected

Latest Webkul QloApps vulnerabilities

• CVE-2026-115326 — QloApps through 1.7.0 IDOR via OrderDetailController Refund Request (CVSS 5.4)
• CVE-2026-110229 — QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips (CVSS 5.4)
• CVE-2026-110226 — QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation (CVSS 5.4)
• CVE-2026-110224 — QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors (CVSS 5.4)
• CVE-2026-110221 — QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value (CVSS 5.4)
• CVE-2026-110219 — QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field (CVSS 5.4)
• CVE-2026-109393 — QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers (CVSS 6.3)
• CVE-2026-107702 — QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking (CVSS 4.3)
• CVE-2026-105836 — QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms (CVSS 5.4)
• CVE-2026-103590 — QloApps through 1.7.0 Reflected XSS via Length of Stay Fields (CVSS 5.4)
• CVE-2026-103589 — QloApps through 1.7.0 Reflected XSS via Room Type Editor (CVSS 5.4)
• CVE-2026-103588 — QloApps through 1.7.0 Reflected XSS via exceptions field (CVSS 5.4)
• CVE-2026-103587 — QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters (CVSS 5.4)
• CVE-2026-93988 — QloApps through 1.7.0 Arbitrary File Read via getEmailHTML (CVSS 6.5)
• CVE-2026-92234 — QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors (CVSS 5.4)
• CVE-2026-89268 — QloApps through 1.7.0 Reflected XSS via List Filter Parameters (CVSS 5.4)
• CVE-2026-75498 — Webkul QloApps SQL injection (CVSS 7.2)
• CVE-2026-75497 — Webkul QloApps SQL injection (CVSS 7.2)
• CVE-2026-75496 — Webkul QloApps improper file upload validation (CVSS 7.2)
• CVE-2021-41074 — (CVSS 5.4)
• CVE-2025-67325 — (CVSS 9.8)
• CVE-2025-10759 — Webkul QloApps CSRF Token authorization (CVSS 5.3)
• CVE-2025-6173 — Webkul QloApps ajax_products_list.php sql injection (CVSS 7.2)
• CVE-2025-26058 — (CVSS 4.2)
• CVE-2025-1155 — Webkul QloApps Your Location Search stores cross site scripting (CVSS 6.1)