10
CVEs
0
Critical
3
High
0
KEV
6
PoC
0
Unpatched C/H
40.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
3
MEDIUM
1
LOW
6
Monthly CVE Trend
Affected Products (9)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-75496 | Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executable files - including PHP webshells - to a publicly accessible server directory and achieve full server-side remote code execution. The booking document upload workflow in the hotel reservation module failed to validate file extensions or inspect MIME types server-side, trusting client-supplied metadata entirely. Upstream fix commit 153ec1c is available via GitHub PR #1801; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.6 | 0.5% | 44 |
|
| CVE-2026-75497 | SQL injection in Webkul QloApps exposes the entire database to remote authenticated administrators who can supply unsanitized input to the 'bo_query' parameter in the back-office search interface. The patch diff reveals the flaw extends beyond CustomerMessage.php to Address.php and multiple hotel reservation system modules (HotelBranchRefundRules, HotelRoomTypeFeaturePricing, HotelRoomTypeGlobalDemandAdvanceOption), all of which concatenated user-supplied strings directly into SQL queries without pSQL() sanitization or integer casting. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data was not provided in the source intelligence. | HIGH | 8.6 | 0.4% | 43 |
|
| CVE-2026-75498 | SQL injection in Webkul QloApps back-office address search allows a remote attacker holding valid administrator credentials to execute arbitrary SQL via the unsanitized 'bo_query' parameter passed to the 'searchByName()' method in 'Address.php'. The scope of the patch (commit 123c97c, PR #1783) reveals the flaw spans at least five PHP files - including 'CustomerMessage.php' and three hotel reservation module classes - each inserting raw user input directly into LIKE or IN SQL clauses without using QloApps' own 'pSQL()' sanitization or integer casting. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. | HIGH | 8.6 | 0.4% | 43 |
|
| CVE-2026-19996 | Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged users to access customer behavior data beyond their authorization scope. The vulnerability affects all Bagisto releases from 2.4.0 through 2.4.4 at the /admin/customers endpoint via manipulation of the ID parameter. A publicly available proof-of-concept exploit exists on GitHub; the vendor has acknowledged the issue and confirmed partial internal remediation with remaining fixes planned for upcoming releases. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-75082 | Cross-site scripting in Webkul Bagisto up to version 2.4.4 allows remote unauthenticated attackers to inject script-related HTML tags via the first_name or last_name parameters submitted to the /customer/register endpoint, with impact routed through the Customer-Registration Notification Email component. The CVSS 4.0 score of 2.1 reflects constrained real-world impact - user interaction is required and integrity impact is low - but a publicly available proof-of-concept on GitHub documents and lowers the bar for this attack. The vendor acknowledged the findings, confirming some issues have been addressed internally, though no specific patched release version has been publicly identified. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-19994 | Authorization bypass in Webkul Bagisto's cache management endpoint allows authenticated low-privileged remote attackers to execute unauthorized cache management operations by manipulating the `action` parameter at `/admin/configuration/cache-management/execute`. Affected versions span the entire 2.4.x branch (2.4.0 through 2.4.4), with CWE-639 (Authorization Bypass Through User-Controlled Key) as the root cause. A public proof-of-concept exploit has been released, and the vendor has confirmed awareness with partial remediation underway - though no specific fixed version has been disclosed; no public exploit identified at time of analysis maps to confirmed active exploitation in CISA KEV. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-19993 | RMA state validation in Webkul Bagisto 2.4.0-2.4.4 permits authenticated customers to bypass the intended Return Merchandise Authorization workflow by submitting crafted requests to /customer/account/rma/update-status, forcing unauthorized state transitions without merchant review. An authenticated customer can escalate an RMA to an approved or completed state outside the designed approval sequence, enabling potential fraudulent return processing. A public proof-of-concept exploit exists; the vendor has confirmed internal awareness and is addressing the issues in upcoming releases, though no specific patched version has been publicly confirmed. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-19997 | Authorization bypass in Bagisto's backend RMA endpoint allows authenticated admin-level users to access or manipulate Return Merchandise Authorization records they are not authorized to view or modify, affecting all Bagisto releases through version 2.4.4. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class weakness in the /admin/sales/rma/requests handler, enabling horizontal privilege escalation across sales data within the admin panel. A public proof-of-concept exploit is available on GitHub; however, the CVSS 4.0 score of 2.0 and the PR:H requirement confirm that exploitation is bounded to already-authenticated high-privilege accounts, not unauthenticated external actors. | LOW | 2.0 | 0.4% | 30 |
PoC
No patch
|
| CVE-2026-19995 | Cross-site scripting in Webkul Bagisto's RMA Message Handler (versions 2.4.0-2.4.4) allows authenticated customers to inject arbitrary JavaScript via the message argument at the /customer/account/rma/send-message endpoint, with execution occurring in the browser of any privileged user (e.g., store administrator) who reviews the RMA thread. A public proof-of-concept exploit is available on GitHub, lowering the exploitation barrier. The vendor has acknowledged the issues were already identified internally, with partial fixes applied and remaining items deferred to upcoming releases - no confirmed patched version has been published. | LOW | 2.0 | 0.2% | 30 |
PoC
No patch
|
| CVE-2026-89268 | Reflected XSS in QloApps back-office (through version 1.7.0) allows an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session by inducing an authenticated admin to submit a specially crafted POST request to back-office list controller endpoints. The root cause, confirmed by the GitHub patch diff, is the Smarty template `list_header.tpl` interpolating `$smarty.post` filter parameters directly into HTML input `value` attributes without the `|escape:'html':'UTF-8'` modifier - affecting at minimum five distinct interpolation points across date-range and text-filter inputs. Successful exploitation enables session-scoped impact including administrative credential harvesting and unauthorized back-office actions; no public exploit code or active exploitation has been identified at time of analysis. | MEDIUM | 5.1 | 0.2% | 26 |
|