Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

QloApps — Vulnerabilities & Security Advisories 27

All 27 CVE vulnerabilities found in QloApps, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with the vendor QloApps, specifically focusing on software weaknesses within their product ecosystem. The collection encompasses a diverse range of security flaws reported over the past five years, including issues related to access control failures, data exposure risks, and improper input validation. Readers can utilize this resource to track the vendor's advisory history, analyze specific weakness classes for pattern recognition, or review the complete vulnerability timeline for a particular QloApps application. By consolidating these records, the page provides a structured view of how security issues have evolved across their releases. This aggregation allows security professionals to identify recurring themes in the vendor's codebase and assess the long-term stability of their products. The data is organized to facilitate quick identification of critical exposures without requiring navigation through multiple disparate sources. Users can filter entries by severity, vulnerability type, or affected component to tailor the information to their specific audit needs. This centralized index serves as a reference point for understanding the security posture of QloApps solutions, enabling teams to prioritize remediation efforts based on historical trends and current threat landscapes. The focus remains strictly on technical vulnerability data, providing a factual basis for risk assessment and compliance reporting related to this specific vendor.

Vendor: Webkul

CVE ID Title CVSS Severity Published
CVE-2026-116746 QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview CWE-639 5.3 Medium 2026-10-26
CVE-2026-116745 QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation CWE-639 6.5 Medium 2026-10-26
CVE-2026-115326 QloApps through 1.7.0 IDOR via OrderDetailController Refund Request CWE-639 5.4 Medium 2026-10-22
CVE-2026-110229 QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips CWE-862 5.4 Medium 2026-10-13
CVE-2026-110226 QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation CWE-639 5.4 Medium 2026-10-13
CVE-2026-110224 QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors CWE-79 5.4 Medium 2026-10-13
CVE-2026-110221 QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value CWE-79 5.4 Medium 2026-10-13
CVE-2026-110219 QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field CWE-79 5.4 Medium 2026-10-13
CVE-2026-109393 QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers CWE-639 6.3 Medium 2026-10-12
CVE-2026-107702 QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking CWE-639 4.3 Medium 2026-10-08
CVE-2026-105836 QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms CWE-639 5.4 Medium 2026-10-06
CVE-2026-103590 QloApps through 1.7.0 Reflected XSS via Length of Stay Fields CWE-79 5.4 Medium 2026-09-30
CVE-2026-103589 QloApps through 1.7.0 Reflected XSS via Room Type Editor CWE-79 5.4 Medium 2026-09-30
CVE-2026-103588 QloApps through 1.7.0 Reflected XSS via exceptions field CWE-79 5.4 Medium 2026-09-30
CVE-2026-103587 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters CWE-79 5.4 Medium 2026-09-30
CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML CWE-22 6.5 Medium 2026-09-19
CVE-2026-92234 QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors CWE-79 5.4 Medium 2026-09-15
CVE-2026-89268 QloApps through 1.7.0 Reflected XSS via List Filter Parameters CWE-79 5.4 Medium 2026-09-12
CVE-2026-75498 Webkul QloApps SQL injection CWE-89 7.2 High 2026-08-25
CVE-2026-75497 Webkul QloApps SQL injection CWE-89 7.2 High 2026-08-25
CVE-2026-75496 Webkul QloApps improper file upload validation CWE-434 7.2 High 2026-08-25
CVE-2026-25558 QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager CWE-79 4.8 Medium 2026-06-08
CVE-2026-25861 QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php CWE-916 5.9 Medium 2026-06-02
CVE-2025-10759 Webkul QloApps CSRF Token authorization CWE-639 5.3 Medium 2025-09-21
CVE-2025-6173 Webkul QloApps ajax_products_list.php sql injection CWE-89 4.7 Medium 2025-06-17
CVE-2025-1155 Webkul QloApps Your Location Search stores cross site scripting CWE-79 4.3 Medium 2025-02-10
CVE-2025-1074 Webkul QloApps URL mylogout cross-site request forgery CWE-352 4.3 Medium 2025-02-06

All 27 known CVE vulnerabilities affecting QloApps with full Chinese analysis, references, and POCs where available.