GCVE - cpe:2.3:a:webkul:qloapps:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:webkul:qloapps:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Webkul (`08ad6940-8efb-5f93-af42-cb470e3ac46e`)
Product	Qloapps (`48ee096e-ad28-59e5-9e1a-70dc4b932680`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-89268`	vulnerable	2026-09-16 04:34:09.384431	QloApps through 1.7.0 Reflected XSS via List Filter Parameters MEDIUM (5.4) QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions. Published: 2026-09-12T01:50:33.852Z Updated: 2026-10-06T13:37:01.815Z Open on db.gcve.eu Reference links https://github.com/Qloapps/QloApps/pull/1801 https://github.com/Qloapps/QloApps/commit/153ec1c8567798bd99155098ecc0a340e38f25bf https://github.com/Qloapps/QloApps/blob/v1.7.0/admin/themes/default/template/helpers/list/list_header.tpl https://github.com/Qloapps/QloApps https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-list-filter-parameters	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-92234`	vulnerable	2026-09-16 04:33:07.926274	QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors MEDIUM (5.4) QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter. Published: 2026-09-15T20:56:46.515Z Updated: 2026-10-06T13:37:02.459Z Open on db.gcve.eu Reference links https://github.com/Qloapps/QloApps/pull/1796 https://github.com/Qloapps/QloApps/commit/54a3b30e4e5c2d6b224dc8fe55e75db173064b91 https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/controllers/admin/AdminHotelfeaturesController.php https://hackmd.io/@leediay/r1aoFrMFGl https://github.com/Qloapps/QloApps	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-6173`	vulnerable	2026-06-08 07:43:14.485427	Webkul QloApps ajax_products_list.php sql injection MEDIUM (4.7) A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_products_list.php. The manipulation of the argument packItself leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this flaw but considers it a low-level issue due to admin privilege pre-requisites. Still, a fix is planned for a future release. Published: 2025-06-17T06:31:07.243Z Updated: 2025-06-17T15:00:14.160Z Open on db.gcve.eu Reference links https://vuldb.com/?id.312661 https://vuldb.com/?ctiid.312661 https://vuldb.com/?submit.593679 https://github.com/caigo8/CVE-md/blob/main/QloApps/SQL_Injection.md https://github.com/caigo8/CVE-md/blob/main/QloApps/SQL_Injection.md#vulnerability-recurrence	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-67325`	vulnerable	2026-06-08 07:41:19.801435	Details available Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution. Published: 2026-01-08T00:00:00.000Z Updated: 2026-01-08T19:00:01.475Z Open on db.gcve.eu Reference links https://github.com/Qloapps/QloApps https://github.com/mr7s3d0/CVE-2025-67325	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-1155`	vulnerable	2026-06-08 07:06:37.047627	Webkul QloApps Your Location Search stores cross site scripting MEDIUM (4.3) A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the component Your Location Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. It is planned to remove this page in the long term. Published: 2025-02-10T20:00:13.333Z Updated: 2025-02-10T20:51:58.656Z Open on db.gcve.eu Reference links https://vuldb.com/?id.295059 https://vuldb.com/?ctiid.295059 https://vuldb.com/?submit.492777 https://github.com/mano257200/Qloapp-XSS-Vulnerability/tree/main	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-1074`	vulnerable	2026-06-08 07:06:36.752291	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-10759`	vulnerable	2026-06-08 07:02:27.465652	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-36235`	vulnerable	2026-06-08 06:06:28.660445	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.