Product by Webkul

    Webkul QloApps

    33 known vulnerabilities in Webkul QloApps (Webkul), 0 of them actively exploited (CISA KEV).

    Key figures

    33

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Webkul QloApps (Webkul)
    MediumCVE-2023-30256

    Webkul QloApps: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2023-36284

    Webkul QloApps: SQL Injection

    		7.5
    HighCVE-2026-75496

    Webkul QloApps improper file upload validation

    		7.2
    HighCVE-2026-75498

    Webkul QloApps SQL injection

    		7.2
    HighCVE-2026-75497

    Webkul QloApps SQL injection

    		7.2
    CriticalCVE-2025-67325

    Webkul QloApps: Unrestricted Upload of File with Dangerous Type

    		9.8
    HighCVE-2026-93988

    QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

    		6.5
    HighCVE-2024-40318

    Webkul QloApps: Unrestricted File Upload

    		7.2
    MediumCVE-2023-36287

    Webkul QloApps: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2023-36289

    Webkul QloApps: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2026-107702

    QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking

    		4.3
    MediumCVE-2026-109393

    QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers

    		6.3
    MediumCVE-2026-110219

    QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field

    		5.4
    MediumCVE-2026-105836

    QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms

    		5.4
    MediumCVE-2026-110224

    QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors

    		5.4
    MediumCVE-2026-110229

    QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips

    		5.4
    MediumCVE-2026-110226

    QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation

    		5.4
    MediumCVE-2026-110221

    QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value

    		5.4
    MediumCVE-2026-115326

    QloApps through 1.7.0 IDOR via OrderDetailController Refund Request

    		5.4
    MediumCVE-2023-36235

    Webkul QloApps: Information Disclosure

    		6.5
    MediumCVE-2026-92234

    QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors

    		5.4
    MediumCVE-2026-103588

    QloApps through 1.7.0 Reflected XSS via exceptions field

    		5.4
    MediumCVE-2026-103589

    QloApps through 1.7.0 Reflected XSS via Room Type Editor

    		5.4
    MediumCVE-2026-103587

    QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters

    		5.4
    MediumCVE-2026-89268

    QloApps through 1.7.0 Reflected XSS via List Filter Parameters

    		5.4

    All vulnerabilities in search

    All products by Webkul