Webkul vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20241
3. 20256
4. 202643
5. 20261

Newest CVEs

• CVE-2026-121733

  Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload

  Webkul · Bagisto

  Low2.1
• CVE-2026-115326

  QloApps through 1.7.0 IDOR via OrderDetailController Refund Request

  Webkul · QloApps

  Medium5.3
• CVE-2026-112193

  Webkul Aureus ERP UserForm.php weak password

  Webkul · Aureus ERP

  Medium6.3
• CVE-2026-112190

  Webkul Aureus ERP composer.json insertion of sensitive information into debugging code

  Webkul · Aureus ERP

  Medium6.9
• CVE-2026-111284

  Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal

  Webkul · Aureus ERP

  Medium5.1
• CVE-2026-110229

  QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips

  Webkul · QloApps

  Medium5.3
• CVE-2026-110226

  QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation

  Webkul · QloApps

  Medium5.3
• CVE-2026-110224

  QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors

  Webkul · QloApps

  Medium5.1
• CVE-2026-110221

  QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value

  Webkul · QloApps

  Medium5.1
• CVE-2026-110219

  QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field

  Webkul · QloApps

  Medium5.1