25
CVEs
4
Critical
8
High
0
KEV
19
PoC
3
Unpatched C/H
40.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
8
MEDIUM
3
LOW
10
Monthly CVE Trend
Affected Products (9)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-67325 | QloApps hotel management system (through 1.7.0) allows unauthenticated web shell upload through the hotel review feature. Attackers can achieve immediate remote code execution. PoC available. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
No patch
|
| CVE-2026-21448 | Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address fields during checkout. A normal customer can inject Blade template code that executes when viewed in the admin panel, achieving RCE. PoC available. | CRITICAL | 9.8 | 0.2% | 69 |
PoC
|
| CVE-2026-21446 | Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauthenticated attackers to re-run the installer and take full control of the store including database credentials and admin account. PoC available. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
|
| CVE-2017-20262 | Joomla!. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.3% | 64 |
PoC
No patch
|
| CVE-2026-21449 | Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable first and last name fields, allowing low-privilege authenticated users to achieve remote code execution. This high-severity vulnerability (CVSS 8.8) affects confidentiality, integrity, and availability with public exploit code available and no patch currently deployed. Organizations running affected Bagisto instances should immediately upgrade to version 2.3.10 or later. | HIGH | 8.8 | 0.0% | 64 |
PoC
|
| CVE-2026-9506 | Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the web root by injecting path traversal sequences into the filename parameter of the ImageCacheController. The CVSS 4.0 base score of 8.7 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality impact, and no public exploit identified at time of analysis. | HIGH | 8.7 | 0.2% | 64 |
PoC
No patch
|
| CVE-2026-21451 | Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting malicious HTTP requests, enabling persistent JavaScript injection that executes when administrators view or edit pages. Public exploit code exists for this vulnerability, creating high-risk scenarios including admin account compromise and backend system hijacking. Bagisto versions prior to 2.3.10 are affected, and no patch is currently available for the underlying Laravel platform. | HIGH | 8.4 | 0.0% | 62 |
PoC
|
| CVE-2026-21447 | Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH] | HIGH | 7.1 | 0.0% | 56 |
PoC
|
| CVE-2026-21450 | Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like CVE-2026-21448, this enables remote code execution through the Blade template engine. Patch available in 2.3.10. | CRITICAL | 9.8 | 0.7% | 50 |
|
| CVE-2025-10759 | A vulnerability was detected in Webkul QloApps up to 1.7.0. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2026-75496 | Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executable files - including PHP webshells - to a publicly accessible server directory and achieve full server-side remote code execution. The booking document upload workflow in the hotel reservation module failed to validate file extensions or inspect MIME types server-side, trusting client-supplied metadata entirely. Upstream fix commit 153ec1c is available via GitHub PR #1801; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.6 | 0.5% | 44 |
|
| CVE-2026-75497 | SQL injection in Webkul QloApps exposes the entire database to remote authenticated administrators who can supply unsanitized input to the 'bo_query' parameter in the back-office search interface. The patch diff reveals the flaw extends beyond CustomerMessage.php to Address.php and multiple hotel reservation system modules (HotelBranchRefundRules, HotelRoomTypeFeaturePricing, HotelRoomTypeGlobalDemandAdvanceOption), all of which concatenated user-supplied strings directly into SQL queries without pSQL() sanitization or integer casting. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data was not provided in the source intelligence. | HIGH | 8.6 | 0.4% | 43 |
|
| CVE-2026-75498 | SQL injection in Webkul QloApps back-office address search allows a remote attacker holding valid administrator credentials to execute arbitrary SQL via the unsanitized 'bo_query' parameter passed to the 'searchByName()' method in 'Address.php'. The scope of the patch (commit 123c97c, PR #1783) reveals the flaw spans at least five PHP files - including 'CustomerMessage.php' and three hotel reservation module classes - each inserting raw user input directly into LIKE or IN SQL clauses without using QloApps' own 'pSQL()' sanitization or integer casting. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. | HIGH | 8.6 | 0.4% | 43 |
|
| CVE-2026-19996 | Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged users to access customer behavior data beyond their authorization scope. The vulnerability affects all Bagisto releases from 2.4.0 through 2.4.4 at the /admin/customers endpoint via manipulation of the ID parameter. A publicly available proof-of-concept exploit exists on GitHub; the vendor has acknowledged the issue and confirmed partial internal remediation with remaining fixes planned for upcoming releases. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-75082 | Cross-site scripting in Webkul Bagisto up to version 2.4.4 allows remote unauthenticated attackers to inject script-related HTML tags via the first_name or last_name parameters submitted to the /customer/register endpoint, with impact routed through the Customer-Registration Notification Email component. The CVSS 4.0 score of 2.1 reflects constrained real-world impact - user interaction is required and integrity impact is low - but a publicly available proof-of-concept on GitHub documents and lowers the bar for this attack. The vendor acknowledged the findings, confirming some issues have been addressed internally, though no specific patched release version has been publicly identified. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|