Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 37

Export CSV
CVE-2026-115326

QloApps through 1.7.0 IDOR via OrderDetailController Refund Request

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-116745

QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Qloapps Webkul
Products
Qloapps Qloapps
CVE-2026-116746

QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Qloapps Webkul
Products
Qloapps Qloapps
CVE-2026-109393

QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htl_access hotel checks. Hotel-restricted employees can supply other hotels' sequential identifiers to read, upload and delete booking documents and delete rooms, room images and hotel images.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-110226

QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation

QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign hotel IDs to AdminProductsController, creating rooms and inventory under other hotels.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-110221

QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature_price_name and impact_value POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted request via a malicious link or auto-submitting form, executing JavaScript in their administrative session.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-105836

QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id_rooms parameter to change status, floor, comments, or inactive dates, disrupting availability and bookings.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-110229

QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund records, exposing customer identities and amounts.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-110224

QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing JavaScript in that user's administrative session.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-110219

QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescaped price value is re-rendered after failing validation, executing JavaScript in the administrative session.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-107702

QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter on the Book Now page to view room availability and booking status of hotels outside their assigned profile access.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-103588

QloApps through 1.7.0 Reflected XSS via exceptions field

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's session when the victim follows the link.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-103589

QloApps through 1.7.0 Reflected XSS via Room Type Editor

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious payloads to execute arbitrary JavaScript in the victim's administrative session.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-103587

QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where date_to and id_room_type parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript payload in these parameters that executes in an authenticated administrator's session when the victim follows the link.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-103590

QloApps through 1.7.0 Reflected XSS via Length of Stay Fields

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restriction_min_los and restriction_max_los parameters, executing arbitrary JavaScript in the victim's administrative session.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-93988

QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-92234

QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-89268

QloApps through 1.7.0 Reflected XSS via List Filter Parameters

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-75496

Webkul QloApps improper file upload validation

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-75497

Webkul QloApps SQL injection

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps