Webkul vulnerabilities

CVE-2026-110229 Medium · 5.4 CWE-862 Oct 13, 2026

QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund records, exposing customer identities and amounts.

CVE-2026-110226 Medium · 5.4 CWE-639 Oct 13, 2026

QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation

QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign hotel IDs to AdminProductsController, creating rooms and inventory under other hotels.

CVE-2026-110224 Medium · 5.4 CWE-79 Oct 13, 2026

QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing JavaScript in that user's administrative session.

CVE-2026-110221 Medium · 5.4 CWE-79 Oct 13, 2026

QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature_price_name and impact_value POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted request via a malicious link or auto-submitting form, executing JavaScript in their administrative session.

CVE-2026-110219 Medium · 5.4 CWE-79 Oct 13, 2026

QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescaped price value is re-rendered after failing validation, executing JavaScript in the administrative session.

CVE-2026-110218 Low · 3.7 CWE-862 Oct 13, 2026

Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish date because PostResource skips authorization and ViewPost ignores is_published.

CVE-2026-109393 Medium · 6.3 CWE-639 Oct 12, 2026

QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htl_access hotel checks. Hotel-restricted employees can supply other hotels' sequential identifiers to read, upload and delete booking documents and delete rooms, room images and hotel images.

CVE-2026-107702 Medium · 4.3 CWE-639 Oct 8, 2026

QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter on the Book Now page to view room availability and booking status of hotels outside their assigned profile access.

CVE-2026-105836 Medium · 5.4 CWE-639 Oct 6, 2026

QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id_rooms parameter to change status, floor, comments, or inactive dates, disrupting availability and bookings.

CVE-2026-97062 Medium · 5.4 CWE-79 Sep 24, 2026

Aureus ERP 1.6.0 Stored XSS via SVG File Upload

Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.

CVE-2026-93988 Medium · 6.5 CWE-22 Sep 19, 2026

QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.

CVE-2017-20262 High · 8.2 CWE-89 Jun 19, 2026

Joomla! Component Ajax Quiz 1.8 SQL Injection

Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cid parameter. Attackers can send GET requests to index.php with the option=com_ajaxquiz and view=ajaxquiz parameters to extract sensitive database information including table names and column structures.

CVE-2026-9506 High · 8.7 Public exploit CWE-22 Jun 8, 2026

Path Traversal Vulnerability in Bagisto

This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter to access arbitrary files outside the intended directory on the targeted system. Successful exploitation of this vulnerability could allow an attacker to read arbitrary sensitive files on the targeted system.

CVE-2026-38532 High · 8.1 CWE-639 Apr 14, 2026

Authorization Bypass Through User-Controlled Key (IDOR) in Webkul Krayin Crm

A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request.

CVE-2026-38530 High · 8.1 CWE-639 Apr 14, 2026

Authorization Bypass Through User-Controlled Key (IDOR) in Webkul Krayin Crm

A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.

CVE-2026-38529 High · 8.8 CWE-269 Apr 14, 2026

Improper Privilege Management in Webkul Krayin Crm

A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.

CVE-2021-41074 Medium · 5.4 CWE-352 Jan 12, 2026

Cross-Site Request Forgery (CSRF) in Webkul Qloapps

A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document.

CVE-2025-67325 Critical · 9.8 CWE-434 Jan 8, 2026

Unrestricted Upload of File with Dangerous Type in Webkul Qloapps

Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.

CVE-2026-21451 High · 8.4 CWE-79 Jan 2, 2026

Bagisto has HTML Filter Bypass that Enables Stored XSS

Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize `<script>` tags, the filtering can be bypassed by manipulating the raw HTTP POST request before submission. As a result, arbitrary JavaScript can be stored in the CMS content and executed whenever the page is viewed or edited. This exposes administrators to a high-severity risk, including complete account takeover, backend hijacking, and malicious script execution. Version 2.3.10 fixes the issue.

CVE-2026-21450 Critical · 9.8 CWE-1336 Jan 2, 2026

Bagisto has SSTI in parameter that can lead to RCE

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.

CVE-2026-21449 High · 8.8 CWE-1336 Jan 2, 2026

Bagisto has SSTI via first and last name from low-privilege user (not admin)

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.

CVE-2026-21448 Critical · 9.8 CWE-1336 Jan 2, 2026

Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.

CVE-2026-21447 High · 7.1 CWE-284 Jan 2, 2026

Bagisto has IDOR in Customer Order Reorder Functionality

Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.

CVE-2026-21446 Critical · 9.8 CWE-306 Jan 2, 2026

Bagisto Missing Authentication on Installer API Endpoints

Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.

CVE-2025-62418 Medium · 4.8 CWE-79 Oct 16, 2025

bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.