CVE-2021-41074

all versions

A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HT

5.4MEDIUM

CVE-2025-67325

<= 1.7.0

Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers

9.8CRITICAL

CVE-2025-10759

<= 1.7.0

A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler.

5.3MEDIUM

CVE-2025-6173

all versions

A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionali

4.7MEDIUM

CVE-2025-26058

all versions

Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protect

4.2MEDIUM

CVE-2025-1155

all versions

A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file

4.3MEDIUM

CVE-2025-1074

all versions

A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the fi

4.3MEDIUM

CVE-2024-40318

all versions

An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a craft

7.2HIGH

CVE-2023-36235

< 1.6.0

An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter.

6.5MEDIUM

CVE-2023-36287

all versions

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's se

6.1MEDIUM

CVE-2023-36284

all versions

An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product all

7.5HIGH

CVE-2023-36289

all versions

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's se

6.1MEDIUM

CVE-2023-36288

all versions

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's se

5.4MEDIUM

CVE-2023-30256

all versions

Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via th

6.1MEDIUM