Webkul
Monthly
Path traversal in QloApps through 1.7.0 lets an authenticated back-office user read arbitrary files from the web server by supplying directory-traversal sequences in the 'email' parameter of the getEmailHTML action in admin/ajax.php. Because the vulnerable code passes an attacker-controlled path to file_get_contents without verifying it stays inside the mail template directory, stolen files can include configuration and database-credential material, giving a limited-privilege admin user read access to data far beyond their intended scope. Publicly available exploit code exists (a detailed write-up is referenced), but there is no evidence of confirmed active exploitation in the wild; the vendor fix is available upstream as PR #1719 / commit 8015495c, so exposure is realistically limited to unpatched installations.
Privilege escalation in Webkul Bagisto 2.4.9 lets an authenticated backend user who holds only the settings.users.edit permission promote their own account to the Administrator role, gaining every admin-panel capability including store configuration, payment-gateway credentials and customer PII. Exploitation needs a valid low-privileged admin-panel credential but no user interaction and no non-default configuration; the admin.settings.users.update endpoint (UserController::update()) simply fails to verify who may grant a role, whether a user may change their own role, or whether the granted role's permissions are a subset of the actor's own. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.15% (5th percentile), but a successful self-promotion delivers full confidentiality, integrity and availability impact (CVSS 8.8, PR:L, no UI).
SQL injection in Webkul QloApps back-office address search allows a remote attacker holding valid administrator credentials to execute arbitrary SQL via the unsanitized 'bo_query' parameter passed to the 'searchByName()' method in 'Address.php'. The scope of the patch (commit 123c97c, PR #1783) reveals the flaw spans at least five PHP files - including 'CustomerMessage.php' and three hotel reservation module classes - each inserting raw user input directly into LIKE or IN SQL clauses without using QloApps' own 'pSQL()' sanitization or integer casting. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
SQL injection in Webkul QloApps exposes the entire database to remote authenticated administrators who can supply unsanitized input to the 'bo_query' parameter in the back-office search interface. The patch diff reveals the flaw extends beyond CustomerMessage.php to Address.php and multiple hotel reservation system modules (HotelBranchRefundRules, HotelRoomTypeFeaturePricing, HotelRoomTypeGlobalDemandAdvanceOption), all of which concatenated user-supplied strings directly into SQL queries without pSQL() sanitization or integer casting. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data was not provided in the source intelligence.
Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executable files - including PHP webshells - to a publicly accessible server directory and achieve full server-side remote code execution. The booking document upload workflow in the hotel reservation module failed to validate file extensions or inspect MIME types server-side, trusting client-supplied metadata entirely. Upstream fix commit 153ec1c is available via GitHub PR #1801; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the web root by injecting path traversal sequences into the filename parameter of the ImageCacheController. The CVSS 4.0 base score of 8.7 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality impact, and no public exploit identified at time of analysis.
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting malicious HTTP requests, enabling persistent JavaScript injection that executes when administrators view or edit pages. Public exploit code exists for this vulnerability, creating high-risk scenarios including admin account compromise and backend system hijacking. Bagisto versions prior to 2.3.10 are affected, and no patch is currently available for the underlying Laravel platform.
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like CVE-2026-21448, this enables remote code execution through the Blade template engine. Patch available in 2.3.10.
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable first and last name fields, allowing low-privilege authenticated users to achieve remote code execution. This high-severity vulnerability (CVSS 8.8) affects confidentiality, integrity, and availability with public exploit code available and no patch currently deployed. Organizations running affected Bagisto instances should immediately upgrade to version 2.3.10 or later.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address fields during checkout. A normal customer can inject Blade template code that executes when viewed in the admin panel, achieving RCE. PoC available.
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauthenticated attackers to re-run the installer and take full control of the store including database credentials and admin account. PoC available.
Webkul Aureus ERP through 1.6.0 fails to enforce sufficient password-strength requirements in the user creation/edit form implemented in UserForm.php, allowing accounts to be configured with weak passwords. Remote attackers without prior authentication (PR:N) can exploit this weakness through online password guessing or brute-force attempts, although exploitation is considered difficult (CVSS AC:H) and the direct impact is limited to low confidentiality. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 score is 2.9.
Sensitive information exposure in Webkul Aureus ERP through 1.6.0 allows unauthenticated remote attackers to retrieve debugging-related data reachable via composer.json, and publicly available exploit code exists. The CVSS 4.0 vector shows network reachability with no privileges or user interaction and only low confidentiality impact; integrity and availability are unaffected, and there is no CISA KEV confirmation. Real-world risk is limited to deployments that expose composer.json or associated debug/metadata output, with the product's narrow footprint further reducing exposure.
Stored cross-site scripting in Webkul's Aureus ERP through version 1.6.0 allows an authenticated user holding permission to create Public Holidays or Mandatory Days to store JavaScript in a holiday name, which is then rendered unescaped as an HtmlString inside the Time-Off plugin's Holiday modal. The payload executes in the browser of any HR manager or administrator who opens that modal, enabling session hijacking or privileged actions in the victim's context. Publicly available exploit code exists, but the issue is moderate-priority rather than an emergency: the CVSS 4.0 vector (PR:L/UI:P) requires a valid low-privilege account with holiday-creation rights, and the script only fires when a privileged user actually opens the affected modal rather than self-triggering.
Insecure direct object reference in QloApps through 1.7.0 lets an authenticated, hotel-restricted back-office employee manipulate sequential identifiers to act on resources belonging to other hotels - reading, uploading and deleting booking documents, deleting rooms, room images, room-type product images and hotel images. The flaw is exploitable only in multi-hotel installations that actually use per-hotel scoping via htl_access, and only by a user who already holds a valid low-privilege back-office account (CVSS vector PR:L, so authenticated rather than unauthenticated); a single-hotel deployment or a deployment without hotel-restricted profiles is not meaningfully exposed. Exploitation is a low-severity-to-moderate integrity and confidentiality problem across tenant boundaries rather than an emergency remote compromise: no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), and the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L is consistent with a medium-severity insider authorization issue. Vendor-side fixes exist upstream (PR #1922 and commit 83eb851) but a tagged patched release was not independently confirmed from the supplied data.
Hotel-restricted back-office employees in QloApps through 1.7.0 can modify room records belonging to hotels they are not authorized to manage, because AdminProductsController::ajaxProcessBulkUpdateRooms trusts the client-supplied id_rooms parameter without verifying that those rooms belong to hotels the employee's profile can access. An authenticated low-privileged employee submitting foreign room IDs can change room status, floor, comments, or inactive dates, disrupting availability and bookings at other properties. Rated 5.3, this is a moderate-severity cross-tenant IDOR (CWE-639) that is meaningful only in multi-hotel deployments with non-super-admin, hotel-restricted staff accounts; no public exploit code or confirmed active exploitation was identified at time of analysis, and an upstream fix is available in GitHub PR #1892.
Reflected cross-site scripting in the QloApps back-office (through version 1.7.0) allows an attacker to execute arbitrary JavaScript inside an authenticated administrator's browser session by inducing that admin to submit a crafted POST request to the room type editor's length-of-stay configuration. The payload is injected through the restriction_min_los and restriction_max_los parameters, which are echoed unescaped into HTML input value attributes in admin/themes/default/template/controllers/products/lengthofstay.tpl. Exploitation requires an authenticated back-office session (CVSS vector PR:L) plus administrator interaction (UI:P), so it is a social-engineering-dependent, admin-only reflected XSS rather than a passively triggered or remotely reachable flaw; no public exploit code or active exploitation was identified at time of analysis, though a technical writeup is publicly available. The vendor-supplied CVSS 4.0 score of 5.1 is modest and consistent with the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Reflected cross-site scripting in the QloApps back-office room type editor (all versions through 1.7.0) allows an attacker to execute arbitrary JavaScript in a logged-in administrator's session by inducing that administrator to submit a crafted POST request whose room_num, floor, or comment values are reflected unescaped into HTML input attributes. Exploitation is not self-triggering: it requires an authenticated back-office user and active user interaction, so the practical risk is moderate-to-low despite the administrative context, and each attempt needs a fresh lure because the XSS is non-persistent. No public exploit identified at time of analysis, and an upstream fix is available via the vendor's GitHub pull request and commit, though a tagged patched release version is not independently confirmed.
Reflected cross-site scripting (CWE-79) in QloApps through 1.7.0 lets attackers inject JavaScript through the 'exceptions' parameter of the back-office 'Transplant a module' form, which AdminModulesPositionsController::displayModuleExceptionList() reflects unescaped into an HTML input so the payload executes in an authenticated administrator's browser once the victim follows a crafted link. Exploitation requires a logged-in back-office admin and victim interaction (CVSS 4.0 5.1 Medium; vector PR:L/UI:P, independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), the payload is reflected and non-persistent so each victim must be individually lured, and impact is bounded to low confidentiality/integrity with no availability effect. An upstream fix is available (GitHub PR #1899 / commit 7ed467d, which introduces Tools::safeOutput), and no public exploit is identified at time of analysis.
Reflected cross-site scripting in QloApps 1.7.0 and earlier lets remote attackers inject JavaScript through the date_to and id_room_type parameters of the back-office Hotel Reservation System 'Book Now' search, which executes in the browser of an authenticated administrator who follows a crafted link. Exploitation requires a logged-in back-office administrator (PR:L) and user interaction (UI:R) - the payload is reflected, not stored, so it does not self-propagate and depends on social engineering of a privileged user, which meaningfully constrains real-world impact. This is a genuine but modest-severity issue, not a top-tier priority; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), though public technical write-ups describing the bug exist.
Stored cross-site scripting in Aureus ERP through 1.6.0 allows an authenticated user to upload an SVG file containing embedded JavaScript that is written to the application's public disk and served from the application origin, so the script executes in a victim's browser session when the uploaded file's direct URL is opened. Successful exploitation enables theft of session cookies and CSRF tokens, giving the attacker the ability to act as the victim within the ERP; independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (vendor score 5.1), reflecting a cross-site scripted response that requires a second user to open the crafted file URL. Exploitation prerequisites are non-trivial - the attacker must hold an authenticated account with access to a file-upload field and the victim must navigate to the stored file - and no public exploit identified at time of analysis, so this is best handled as a standard patch-cycle item rather than an emergency.
Reflected XSS in QloApps back-office (through version 1.7.0) allows an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session by inducing an authenticated admin to submit a specially crafted POST request to back-office list controller endpoints. The root cause, confirmed by the GitHub patch diff, is the Smarty template `list_header.tpl` interpolating `$smarty.post` filter parameters directly into HTML input `value` attributes without the `|escape:'html':'UTF-8'` modifier - affecting at minimum five distinct interpolation points across date-range and text-filter inputs. Successful exploitation enables session-scoped impact including administrative credential harvesting and unauthorized back-office actions; no public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in Webkul Bagisto up to version 2.4.4 allows remote unauthenticated attackers to inject script-related HTML tags via the first_name or last_name parameters submitted to the /customer/register endpoint, with impact routed through the Customer-Registration Notification Email component. The CVSS 4.0 score of 2.1 reflects constrained real-world impact - user interaction is required and integrity impact is low - but a publicly available proof-of-concept on GitHub documents and lowers the bar for this attack. The vendor acknowledged the findings, confirming some issues have been addressed internally, though no specific patched release version has been publicly identified.
Authorization bypass in Bagisto's backend RMA endpoint allows authenticated admin-level users to access or manipulate Return Merchandise Authorization records they are not authorized to view or modify, affecting all Bagisto releases through version 2.4.4. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class weakness in the /admin/sales/rma/requests handler, enabling horizontal privilege escalation across sales data within the admin panel. A public proof-of-concept exploit is available on GitHub; however, the CVSS 4.0 score of 2.0 and the PR:H requirement confirm that exploitation is bounded to already-authenticated high-privilege accounts, not unauthenticated external actors.
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged users to access customer behavior data beyond their authorization scope. The vulnerability affects all Bagisto releases from 2.4.0 through 2.4.4 at the /admin/customers endpoint via manipulation of the ID parameter. A publicly available proof-of-concept exploit exists on GitHub; the vendor has acknowledged the issue and confirmed partial internal remediation with remaining fixes planned for upcoming releases.
Cross-site scripting in Webkul Bagisto's RMA Message Handler (versions 2.4.0-2.4.4) allows authenticated customers to inject arbitrary JavaScript via the message argument at the /customer/account/rma/send-message endpoint, with execution occurring in the browser of any privileged user (e.g., store administrator) who reviews the RMA thread. A public proof-of-concept exploit is available on GitHub, lowering the exploitation barrier. The vendor has acknowledged the issues were already identified internally, with partial fixes applied and remaining items deferred to upcoming releases - no confirmed patched version has been published.
Authorization bypass in Webkul Bagisto's cache management endpoint allows authenticated low-privileged remote attackers to execute unauthorized cache management operations by manipulating the `action` parameter at `/admin/configuration/cache-management/execute`. Affected versions span the entire 2.4.x branch (2.4.0 through 2.4.4), with CWE-639 (Authorization Bypass Through User-Controlled Key) as the root cause. A public proof-of-concept exploit has been released, and the vendor has confirmed awareness with partial remediation underway - though no specific fixed version has been disclosed; no public exploit identified at time of analysis maps to confirmed active exploitation in CISA KEV.
RMA state validation in Webkul Bagisto 2.4.0-2.4.4 permits authenticated customers to bypass the intended Return Merchandise Authorization workflow by submitting crafted requests to /customer/account/rma/update-status, forcing unauthorized state transitions without merchant review. An authenticated customer can escalate an RMA to an approved or completed state outside the designed approval sequence, enabling potential fraudulent return processing. A public proof-of-concept exploit exists; the vendor has confirmed internal awareness and is addressing the issues in upcoming releases, though no specific patched version has been publicly confirmed.
Authorization bypass in Webkul Bagisto's backend reporting endpoint (/admin/reporting/sales/) allows authenticated low-privilege users to access sales reporting data outside their intended authorization scope. Affected deployments include Bagisto versions up to and including 2.4.4, confirmed via CPE cpe:2.3:a:webkul:bagisto. A publicly available proof-of-concept exploit has been published on GitHub, and while not listed in CISA KEV, the vendor has acknowledged the issue through internal security assessment, indicating awareness but no confirmed patched release version at this time.
Authorization bypass via Insecure Direct Object Reference (IDOR) in Webkul Bagisto's backend customer detail endpoint allows remote authenticated users to enumerate and retrieve customer records outside their authorized scope by manipulating the ID parameter in requests to /admin/customers/view. Versions up to and including 2.4.4 are confirmed affected per NVD CPE data, and publicly available exploit code exists on GitHub. The vendor has acknowledged the vulnerability class and confirmed that partial remediation is underway internally, though no specific patched release version has been publicly confirmed.
Improper access control in Webkul Bagisto's Customer Item Deletion Endpoint (versions up to 2.4.4) permits a remotely-accessible, authenticated attacker to delete customer items beyond their authorization scope. A public proof-of-concept exploit is available on GitHub, and the vendor has acknowledged the issue, confirming partial fixes have shipped with remaining remediation planned for future releases. This is not currently listed in the CISA KEV catalog, and real-world impact is moderated by the PR:H authentication requirement.
Authorization bypass in Webkul Bagisto's Admin Customer Impersonation Feature (versions up to 2.4.4) allows authenticated administrators to manipulate the ID parameter at /admin/customers/login-as-customer/ to impersonate arbitrary customers beyond their intended authorization scope. The CVSS 4.0 score of 5.1 reflects high-privilege prerequisites (PR:H) and limited impact metrics, but a publicly available proof-of-concept on GitHub meaningfully lowers the exploitation barrier for any attacker who already holds admin credentials. The vendor has acknowledged the vulnerability and confirmed partial internal remediation, with remaining fixes planned for upcoming releases.
Joomla!. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document. [CVSS 5.4 MEDIUM]
QloApps hotel management system (through 1.7.0) allows unauthenticated web shell upload through the hotel review feature. Attackers can achieve immediate remote code execution. PoC available.
Stored cross-site scripting in Bagisto 2.3.7's TinyMCE image-upload feature allows a highly privileged admin-panel user to upload a file named with a .png extension whose contents are HTML/JavaScript; the backend's content sniffing then re-saves it as .html, so the script executes in the browser of any admin or editor who opens it, enabling session hijacking or unauthorized actions against those privileged accounts. Exploitation requires an authenticated account with upload/content privileges (PR:H) plus a victim who actively views the file (UI:R), so it is not remotely triggerable against a default, unattended installation; publicly available exploit code exists, EPSS is 0.28% (19th percentile), and there is no CISA KEV listing. The issue is fixed in Bagisto 2.3.8.
A vulnerability was detected in Webkul QloApps up to 1.7.0. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated low severity (CVSS 2.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
SQL injection in QloApps 1.6.1 admin panel allows authenticated administrators to inject SQL via the packItself parameter in /admin/ajax_products_list.php, potentially leading to unauthorized data access or manipulation. Although the exploit is publicly available, exploitation requires high privileges, and the vendor considers it low severity. The vulnerability is not currently in CISA KEV and has a low EPSS probability.
A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the parameter 'query' in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malicious payload within the username field. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Path traversal in QloApps through 1.7.0 lets an authenticated back-office user read arbitrary files from the web server by supplying directory-traversal sequences in the 'email' parameter of the getEmailHTML action in admin/ajax.php. Because the vulnerable code passes an attacker-controlled path to file_get_contents without verifying it stays inside the mail template directory, stolen files can include configuration and database-credential material, giving a limited-privilege admin user read access to data far beyond their intended scope. Publicly available exploit code exists (a detailed write-up is referenced), but there is no evidence of confirmed active exploitation in the wild; the vendor fix is available upstream as PR #1719 / commit 8015495c, so exposure is realistically limited to unpatched installations.
Privilege escalation in Webkul Bagisto 2.4.9 lets an authenticated backend user who holds only the settings.users.edit permission promote their own account to the Administrator role, gaining every admin-panel capability including store configuration, payment-gateway credentials and customer PII. Exploitation needs a valid low-privileged admin-panel credential but no user interaction and no non-default configuration; the admin.settings.users.update endpoint (UserController::update()) simply fails to verify who may grant a role, whether a user may change their own role, or whether the granted role's permissions are a subset of the actor's own. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.15% (5th percentile), but a successful self-promotion delivers full confidentiality, integrity and availability impact (CVSS 8.8, PR:L, no UI).
SQL injection in Webkul QloApps back-office address search allows a remote attacker holding valid administrator credentials to execute arbitrary SQL via the unsanitized 'bo_query' parameter passed to the 'searchByName()' method in 'Address.php'. The scope of the patch (commit 123c97c, PR #1783) reveals the flaw spans at least five PHP files - including 'CustomerMessage.php' and three hotel reservation module classes - each inserting raw user input directly into LIKE or IN SQL clauses without using QloApps' own 'pSQL()' sanitization or integer casting. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
SQL injection in Webkul QloApps exposes the entire database to remote authenticated administrators who can supply unsanitized input to the 'bo_query' parameter in the back-office search interface. The patch diff reveals the flaw extends beyond CustomerMessage.php to Address.php and multiple hotel reservation system modules (HotelBranchRefundRules, HotelRoomTypeFeaturePricing, HotelRoomTypeGlobalDemandAdvanceOption), all of which concatenated user-supplied strings directly into SQL queries without pSQL() sanitization or integer casting. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data was not provided in the source intelligence.
Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executable files - including PHP webshells - to a publicly accessible server directory and achieve full server-side remote code execution. The booking document upload workflow in the hotel reservation module failed to validate file extensions or inspect MIME types server-side, trusting client-supplied metadata entirely. Upstream fix commit 153ec1c is available via GitHub PR #1801; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the web root by injecting path traversal sequences into the filename parameter of the ImageCacheController. The CVSS 4.0 base score of 8.7 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality impact, and no public exploit identified at time of analysis.
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting malicious HTTP requests, enabling persistent JavaScript injection that executes when administrators view or edit pages. Public exploit code exists for this vulnerability, creating high-risk scenarios including admin account compromise and backend system hijacking. Bagisto versions prior to 2.3.10 are affected, and no patch is currently available for the underlying Laravel platform.
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like CVE-2026-21448, this enables remote code execution through the Blade template engine. Patch available in 2.3.10.
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable first and last name fields, allowing low-privilege authenticated users to achieve remote code execution. This high-severity vulnerability (CVSS 8.8) affects confidentiality, integrity, and availability with public exploit code available and no patch currently deployed. Organizations running affected Bagisto instances should immediately upgrade to version 2.3.10 or later.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address fields during checkout. A normal customer can inject Blade template code that executes when viewed in the admin panel, achieving RCE. PoC available.
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauthenticated attackers to re-run the installer and take full control of the store including database credentials and admin account. PoC available.
Webkul Aureus ERP through 1.6.0 fails to enforce sufficient password-strength requirements in the user creation/edit form implemented in UserForm.php, allowing accounts to be configured with weak passwords. Remote attackers without prior authentication (PR:N) can exploit this weakness through online password guessing or brute-force attempts, although exploitation is considered difficult (CVSS AC:H) and the direct impact is limited to low confidentiality. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 score is 2.9.
Sensitive information exposure in Webkul Aureus ERP through 1.6.0 allows unauthenticated remote attackers to retrieve debugging-related data reachable via composer.json, and publicly available exploit code exists. The CVSS 4.0 vector shows network reachability with no privileges or user interaction and only low confidentiality impact; integrity and availability are unaffected, and there is no CISA KEV confirmation. Real-world risk is limited to deployments that expose composer.json or associated debug/metadata output, with the product's narrow footprint further reducing exposure.
Stored cross-site scripting in Webkul's Aureus ERP through version 1.6.0 allows an authenticated user holding permission to create Public Holidays or Mandatory Days to store JavaScript in a holiday name, which is then rendered unescaped as an HtmlString inside the Time-Off plugin's Holiday modal. The payload executes in the browser of any HR manager or administrator who opens that modal, enabling session hijacking or privileged actions in the victim's context. Publicly available exploit code exists, but the issue is moderate-priority rather than an emergency: the CVSS 4.0 vector (PR:L/UI:P) requires a valid low-privilege account with holiday-creation rights, and the script only fires when a privileged user actually opens the affected modal rather than self-triggering.
Insecure direct object reference in QloApps through 1.7.0 lets an authenticated, hotel-restricted back-office employee manipulate sequential identifiers to act on resources belonging to other hotels - reading, uploading and deleting booking documents, deleting rooms, room images, room-type product images and hotel images. The flaw is exploitable only in multi-hotel installations that actually use per-hotel scoping via htl_access, and only by a user who already holds a valid low-privilege back-office account (CVSS vector PR:L, so authenticated rather than unauthenticated); a single-hotel deployment or a deployment without hotel-restricted profiles is not meaningfully exposed. Exploitation is a low-severity-to-moderate integrity and confidentiality problem across tenant boundaries rather than an emergency remote compromise: no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), and the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L is consistent with a medium-severity insider authorization issue. Vendor-side fixes exist upstream (PR #1922 and commit 83eb851) but a tagged patched release was not independently confirmed from the supplied data.
Hotel-restricted back-office employees in QloApps through 1.7.0 can modify room records belonging to hotels they are not authorized to manage, because AdminProductsController::ajaxProcessBulkUpdateRooms trusts the client-supplied id_rooms parameter without verifying that those rooms belong to hotels the employee's profile can access. An authenticated low-privileged employee submitting foreign room IDs can change room status, floor, comments, or inactive dates, disrupting availability and bookings at other properties. Rated 5.3, this is a moderate-severity cross-tenant IDOR (CWE-639) that is meaningful only in multi-hotel deployments with non-super-admin, hotel-restricted staff accounts; no public exploit code or confirmed active exploitation was identified at time of analysis, and an upstream fix is available in GitHub PR #1892.
Reflected cross-site scripting in the QloApps back-office (through version 1.7.0) allows an attacker to execute arbitrary JavaScript inside an authenticated administrator's browser session by inducing that admin to submit a crafted POST request to the room type editor's length-of-stay configuration. The payload is injected through the restriction_min_los and restriction_max_los parameters, which are echoed unescaped into HTML input value attributes in admin/themes/default/template/controllers/products/lengthofstay.tpl. Exploitation requires an authenticated back-office session (CVSS vector PR:L) plus administrator interaction (UI:P), so it is a social-engineering-dependent, admin-only reflected XSS rather than a passively triggered or remotely reachable flaw; no public exploit code or active exploitation was identified at time of analysis, though a technical writeup is publicly available. The vendor-supplied CVSS 4.0 score of 5.1 is modest and consistent with the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Reflected cross-site scripting in the QloApps back-office room type editor (all versions through 1.7.0) allows an attacker to execute arbitrary JavaScript in a logged-in administrator's session by inducing that administrator to submit a crafted POST request whose room_num, floor, or comment values are reflected unescaped into HTML input attributes. Exploitation is not self-triggering: it requires an authenticated back-office user and active user interaction, so the practical risk is moderate-to-low despite the administrative context, and each attempt needs a fresh lure because the XSS is non-persistent. No public exploit identified at time of analysis, and an upstream fix is available via the vendor's GitHub pull request and commit, though a tagged patched release version is not independently confirmed.
Reflected cross-site scripting (CWE-79) in QloApps through 1.7.0 lets attackers inject JavaScript through the 'exceptions' parameter of the back-office 'Transplant a module' form, which AdminModulesPositionsController::displayModuleExceptionList() reflects unescaped into an HTML input so the payload executes in an authenticated administrator's browser once the victim follows a crafted link. Exploitation requires a logged-in back-office admin and victim interaction (CVSS 4.0 5.1 Medium; vector PR:L/UI:P, independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), the payload is reflected and non-persistent so each victim must be individually lured, and impact is bounded to low confidentiality/integrity with no availability effect. An upstream fix is available (GitHub PR #1899 / commit 7ed467d, which introduces Tools::safeOutput), and no public exploit is identified at time of analysis.
Reflected cross-site scripting in QloApps 1.7.0 and earlier lets remote attackers inject JavaScript through the date_to and id_room_type parameters of the back-office Hotel Reservation System 'Book Now' search, which executes in the browser of an authenticated administrator who follows a crafted link. Exploitation requires a logged-in back-office administrator (PR:L) and user interaction (UI:R) - the payload is reflected, not stored, so it does not self-propagate and depends on social engineering of a privileged user, which meaningfully constrains real-world impact. This is a genuine but modest-severity issue, not a top-tier priority; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), though public technical write-ups describing the bug exist.
Stored cross-site scripting in Aureus ERP through 1.6.0 allows an authenticated user to upload an SVG file containing embedded JavaScript that is written to the application's public disk and served from the application origin, so the script executes in a victim's browser session when the uploaded file's direct URL is opened. Successful exploitation enables theft of session cookies and CSRF tokens, giving the attacker the ability to act as the victim within the ERP; independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (vendor score 5.1), reflecting a cross-site scripted response that requires a second user to open the crafted file URL. Exploitation prerequisites are non-trivial - the attacker must hold an authenticated account with access to a file-upload field and the victim must navigate to the stored file - and no public exploit identified at time of analysis, so this is best handled as a standard patch-cycle item rather than an emergency.
Reflected XSS in QloApps back-office (through version 1.7.0) allows an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session by inducing an authenticated admin to submit a specially crafted POST request to back-office list controller endpoints. The root cause, confirmed by the GitHub patch diff, is the Smarty template `list_header.tpl` interpolating `$smarty.post` filter parameters directly into HTML input `value` attributes without the `|escape:'html':'UTF-8'` modifier - affecting at minimum five distinct interpolation points across date-range and text-filter inputs. Successful exploitation enables session-scoped impact including administrative credential harvesting and unauthorized back-office actions; no public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in Webkul Bagisto up to version 2.4.4 allows remote unauthenticated attackers to inject script-related HTML tags via the first_name or last_name parameters submitted to the /customer/register endpoint, with impact routed through the Customer-Registration Notification Email component. The CVSS 4.0 score of 2.1 reflects constrained real-world impact - user interaction is required and integrity impact is low - but a publicly available proof-of-concept on GitHub documents and lowers the bar for this attack. The vendor acknowledged the findings, confirming some issues have been addressed internally, though no specific patched release version has been publicly identified.
Authorization bypass in Bagisto's backend RMA endpoint allows authenticated admin-level users to access or manipulate Return Merchandise Authorization records they are not authorized to view or modify, affecting all Bagisto releases through version 2.4.4. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class weakness in the /admin/sales/rma/requests handler, enabling horizontal privilege escalation across sales data within the admin panel. A public proof-of-concept exploit is available on GitHub; however, the CVSS 4.0 score of 2.0 and the PR:H requirement confirm that exploitation is bounded to already-authenticated high-privilege accounts, not unauthenticated external actors.
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged users to access customer behavior data beyond their authorization scope. The vulnerability affects all Bagisto releases from 2.4.0 through 2.4.4 at the /admin/customers endpoint via manipulation of the ID parameter. A publicly available proof-of-concept exploit exists on GitHub; the vendor has acknowledged the issue and confirmed partial internal remediation with remaining fixes planned for upcoming releases.
Cross-site scripting in Webkul Bagisto's RMA Message Handler (versions 2.4.0-2.4.4) allows authenticated customers to inject arbitrary JavaScript via the message argument at the /customer/account/rma/send-message endpoint, with execution occurring in the browser of any privileged user (e.g., store administrator) who reviews the RMA thread. A public proof-of-concept exploit is available on GitHub, lowering the exploitation barrier. The vendor has acknowledged the issues were already identified internally, with partial fixes applied and remaining items deferred to upcoming releases - no confirmed patched version has been published.
Authorization bypass in Webkul Bagisto's cache management endpoint allows authenticated low-privileged remote attackers to execute unauthorized cache management operations by manipulating the `action` parameter at `/admin/configuration/cache-management/execute`. Affected versions span the entire 2.4.x branch (2.4.0 through 2.4.4), with CWE-639 (Authorization Bypass Through User-Controlled Key) as the root cause. A public proof-of-concept exploit has been released, and the vendor has confirmed awareness with partial remediation underway - though no specific fixed version has been disclosed; no public exploit identified at time of analysis maps to confirmed active exploitation in CISA KEV.
RMA state validation in Webkul Bagisto 2.4.0-2.4.4 permits authenticated customers to bypass the intended Return Merchandise Authorization workflow by submitting crafted requests to /customer/account/rma/update-status, forcing unauthorized state transitions without merchant review. An authenticated customer can escalate an RMA to an approved or completed state outside the designed approval sequence, enabling potential fraudulent return processing. A public proof-of-concept exploit exists; the vendor has confirmed internal awareness and is addressing the issues in upcoming releases, though no specific patched version has been publicly confirmed.
Authorization bypass in Webkul Bagisto's backend reporting endpoint (/admin/reporting/sales/) allows authenticated low-privilege users to access sales reporting data outside their intended authorization scope. Affected deployments include Bagisto versions up to and including 2.4.4, confirmed via CPE cpe:2.3:a:webkul:bagisto. A publicly available proof-of-concept exploit has been published on GitHub, and while not listed in CISA KEV, the vendor has acknowledged the issue through internal security assessment, indicating awareness but no confirmed patched release version at this time.
Authorization bypass via Insecure Direct Object Reference (IDOR) in Webkul Bagisto's backend customer detail endpoint allows remote authenticated users to enumerate and retrieve customer records outside their authorized scope by manipulating the ID parameter in requests to /admin/customers/view. Versions up to and including 2.4.4 are confirmed affected per NVD CPE data, and publicly available exploit code exists on GitHub. The vendor has acknowledged the vulnerability class and confirmed that partial remediation is underway internally, though no specific patched release version has been publicly confirmed.
Improper access control in Webkul Bagisto's Customer Item Deletion Endpoint (versions up to 2.4.4) permits a remotely-accessible, authenticated attacker to delete customer items beyond their authorization scope. A public proof-of-concept exploit is available on GitHub, and the vendor has acknowledged the issue, confirming partial fixes have shipped with remaining remediation planned for future releases. This is not currently listed in the CISA KEV catalog, and real-world impact is moderated by the PR:H authentication requirement.
Authorization bypass in Webkul Bagisto's Admin Customer Impersonation Feature (versions up to 2.4.4) allows authenticated administrators to manipulate the ID parameter at /admin/customers/login-as-customer/ to impersonate arbitrary customers beyond their intended authorization scope. The CVSS 4.0 score of 5.1 reflects high-privilege prerequisites (PR:H) and limited impact metrics, but a publicly available proof-of-concept on GitHub meaningfully lowers the exploitation barrier for any attacker who already holds admin credentials. The vendor has acknowledged the vulnerability and confirmed partial internal remediation, with remaining fixes planned for upcoming releases.
Joomla!. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document. [CVSS 5.4 MEDIUM]
QloApps hotel management system (through 1.7.0) allows unauthenticated web shell upload through the hotel review feature. Attackers can achieve immediate remote code execution. PoC available.
Stored cross-site scripting in Bagisto 2.3.7's TinyMCE image-upload feature allows a highly privileged admin-panel user to upload a file named with a .png extension whose contents are HTML/JavaScript; the backend's content sniffing then re-saves it as .html, so the script executes in the browser of any admin or editor who opens it, enabling session hijacking or unauthorized actions against those privileged accounts. Exploitation requires an authenticated account with upload/content privileges (PR:H) plus a victim who actively views the file (UI:R), so it is not remotely triggerable against a default, unattended installation; publicly available exploit code exists, EPSS is 0.28% (19th percentile), and there is no CISA KEV listing. The issue is fixed in Bagisto 2.3.8.
A vulnerability was detected in Webkul QloApps up to 1.7.0. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated low severity (CVSS 2.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
SQL injection in QloApps 1.6.1 admin panel allows authenticated administrators to inject SQL via the packItself parameter in /admin/ajax_products_list.php, potentially leading to unauthorized data access or manipulation. Although the exploit is publicly available, exploitation requires high privileges, and the vendor considers it low severity. The vulnerability is not currently in CISA KEV and has a low EPSS probability.
A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the parameter 'query' in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malicious payload within the username field. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.