QL
Product
qloapps
33
CVEs
0
On KEV
9.8
Max CVSS
13
New 30D
Severity mix
Critical 1High 6Medium 26Low 0
Watch
Add qloapps to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-93988 | 6.5 | Sep 19 | QloApps through 1.7.0 Arbitrary File Read via getEmailHTML Affected: through 1.7.0 |
| CVE-2023-36235 | 6.5 | Jan 17 | An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter Affected: before 1.6.0 |
| CVE-2026-109393 | 6.3 | Oct 12 | QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers Affected: through 1.7.0 |
| CVE-2025-1155 | 6.1 | Feb 10 | Webkul QloApps Your Location Search stores cross site scripting Affected: 1.6.1 |
| CVE-2023-36287 | 6.1 | Jun 23 | An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via… Affected: 1.6.0 |
| CVE-2023-36289 | 6.1 | Jun 23 | An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via… Affected: 1.6.0 |
| CVE-2023-30256 | 6.1 | May 11 | Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the… Affected: 1.5.2 |
| CVE-2026-115326 | 5.4 | Oct 22 | QloApps through 1.7.0 IDOR via OrderDetailController Refund Request Affected: through 1.7.0 |
| CVE-2026-110229 | 5.4 | Oct 13 | QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips Affected: through 1.7.0 |
| CVE-2026-110226 | 5.4 | Oct 13 | QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation Affected: through 1.7.0 |
| CVE-2026-110224 | 5.4 | Oct 13 | QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors Affected: through 1.7.0 |
| CVE-2026-110221 | 5.4 | Oct 13 | QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value Affected: through 1.7.0 |
| CVE-2026-110219 | 5.4 | Oct 13 | QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field Affected: through 1.7.0 |
| CVE-2026-105836 | 5.4 | Oct 6 | QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms Affected: through 1.7.0 |
| CVE-2026-103590 | 5.4 | Sep 30 | QloApps through 1.7.0 Reflected XSS via Length of Stay Fields Affected: through 1.7.0 |
| CVE-2026-103589 | 5.4 | Sep 30 | QloApps through 1.7.0 Reflected XSS via Room Type Editor Affected: through 1.7.0 |
| CVE-2026-103588 | 5.4 | Sep 30 | QloApps through 1.7.0 Reflected XSS via exceptions field Affected: through 1.7.0 |
| CVE-2026-103587 | 5.4 | Sep 30 | QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters Affected: through 1.7.0 |
| CVE-2026-92234 | 5.4 | Sep 15 | QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors Affected: through 1.7.0 |
| CVE-2026-89268 | 5.4 | Sep 12 | QloApps through 1.7.0 Reflected XSS via List Filter Parameters Affected: through 1.7.0 |
| CVE-2021-41074 | 5.4 | Jan 12 | A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document Affected: 1.5.1 |
| CVE-2023-36288 | 5.4 | Jun 23 | An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via… Affected: 1.6.0 |
| CVE-2025-10759 | 5.3 | Sep 21 | Webkul QloApps CSRF Token authorization Affected: 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +2 more |
| CVE-2026-107702 | 4.3 | Oct 8 | QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking Affected: through 1.7.0 |
| CVE-2025-1074 | 4.3 | Feb 6 | Webkul QloApps URL mylogout cross-site request forgery Affected: 1.6.1 |
| CVE-2025-26058 | 4.2 | Feb 18 | Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection Affected: 1.6.1 |
Showing 26