# Webkul QloApps.

Every CVE that names Webkul QloApps among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [QloApps through 1.7.0 IDOR via OrderDetailController Refund Request](https://agentprime.io/advisories/CVE-2026-115326.md)
  `CVE-2026-115326` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips](https://agentprime.io/advisories/CVE-2026-110229.md)
  `CVE-2026-110229` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation](https://agentprime.io/advisories/CVE-2026-110226.md)
  `CVE-2026-110226` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors](https://agentprime.io/advisories/CVE-2026-110224.md)
  `CVE-2026-110224` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value](https://agentprime.io/advisories/CVE-2026-110221.md)
  `CVE-2026-110221` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field](https://agentprime.io/advisories/CVE-2026-110219.md)
  `CVE-2026-110219` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers](https://agentprime.io/advisories/CVE-2026-109393.md)
  `CVE-2026-109393` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking](https://agentprime.io/advisories/CVE-2026-107702.md)
  `CVE-2026-107702` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms](https://agentprime.io/advisories/CVE-2026-105836.md)
  `CVE-2026-105836` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [QloApps through 1.7.0 Reflected XSS via Length of Stay Fields](https://agentprime.io/advisories/CVE-2026-103590.md)
  `CVE-2026-103590` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [QloApps through 1.7.0 Reflected XSS via Room Type Editor](https://agentprime.io/advisories/CVE-2026-103589.md)
  `CVE-2026-103589` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [QloApps through 1.7.0 Reflected XSS via exceptions field](https://agentprime.io/advisories/CVE-2026-103588.md)
  `CVE-2026-103588` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters](https://agentprime.io/advisories/CVE-2026-103587.md)
  `CVE-2026-103587` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [QloApps through 1.7.0 Arbitrary File Read via getEmailHTML](https://agentprime.io/advisories/CVE-2026-93988.md)
  `CVE-2026-93988` · CVE record: webkul qloapps · CVSS 7.1 High · Not analysed yet · Published 19 Sept 2026 · Tags: Path traversal
- [QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors](https://agentprime.io/advisories/CVE-2026-92234.md)
  `CVE-2026-92234` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site scripting (XSS)
- [QloApps through 1.7.0 Reflected XSS via List Filter Parameters](https://agentprime.io/advisories/CVE-2026-89268.md)
  `CVE-2026-89268` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Webkul QloApps SQL injection](https://agentprime.io/advisories/CVE-2026-75498.md)
  `CVE-2026-75498` · CVE record: Webkul QloApps · CVSS 8.6 High · Not analysed yet · Published 25 Aug 2026 · Tags: SQL injection
- [Webkul QloApps SQL injection](https://agentprime.io/advisories/CVE-2026-75497.md)
  `CVE-2026-75497` · CVE record: Webkul QloApps · CVSS 8.6 High · Not analysed yet · Published 25 Aug 2026 · Tags: SQL injection
- [Webkul QloApps improper file upload validation](https://agentprime.io/advisories/CVE-2026-75496.md)
  `CVE-2026-75496` · CVE record: Webkul QloApps · CVSS 8.6 High · Not analysed yet · Published 25 Aug 2026 · Tags: Unrestricted file upload
- [Webkul QloApps CSRF Token authorization](https://agentprime.io/advisories/CVE-2025-10759.md)
  `CVE-2025-10759` · CVE record: Webkul QloApps · CVSS 6.9 Medium · Not analysed yet · Published 21 Sept 2025 · Tags: Broken access control
- [Webkul QloApps ajax_products_list.php sql injection](https://agentprime.io/advisories/CVE-2025-6173.md)
  `CVE-2025-6173` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 17 Jun 2025 · Tags: Other injection, SQL injection
- [Webkul QloApps Your Location Search stores cross site scripting](https://agentprime.io/advisories/CVE-2025-1155.md)
  `CVE-2025-1155` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 10 Feb 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Webkul QloApps URL mylogout cross-site request forgery](https://agentprime.io/advisories/CVE-2025-1074.md)
  `CVE-2025-1074` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 6 Feb 2025 · Tags: Cross-site request forgery (CSRF), Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=webkul-qloapps>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/webkul-qloapps/>. Everything for agents: <https://agentprime.io/llms.txt>.