Webkul QloApps vulnerabilities

CVEs per yearBy the year they were published

1. 20254
2. 202619

Newest CVEs

• CVE-2026-115326

  QloApps through 1.7.0 IDOR via OrderDetailController Refund Request

  Webkul · QloApps

  Medium5.3
• CVE-2026-110229

  QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips

  Webkul · QloApps

  Medium5.3
• CVE-2026-110226

  QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation

  Webkul · QloApps

  Medium5.3
• CVE-2026-110224

  QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors

  Webkul · QloApps

  Medium5.1
• CVE-2026-110221

  QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value

  Webkul · QloApps

  Medium5.1
• CVE-2026-110219

  QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field

  Webkul · QloApps

  Medium5.1
• CVE-2026-109393

  QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers

  Webkul · QloApps

  Medium5.3
• CVE-2026-107702

  QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking

  Webkul · QloApps

  Medium5.3
• CVE-2026-105836

  QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms

  Webkul · QloApps

  Medium5.3
• CVE-2026-103590

  QloApps through 1.7.0 Reflected XSS via Length of Stay Fields

  Webkul · QloApps

  Medium5.1