[ Vendor · 19 CVEs ]
Webkul
CVEs affecting Webkul published in the last 30 days, plus any Webkul CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-115326 | 22 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that… | |
| CVE-2026-112190 | 19 Oct 2026 | CVSS 5.3 | Webkul Aureus ERPA security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json… | |
| CVE-2026-112193 | 19 Oct 2026 | CVSS 3.7 | Webkul Aureus ERPA vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file… | |
| CVE-2026-111284 | 15 Oct 2026 | CVSS 5.4 | Webkul Aureus ERPAureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts… | |
| CVE-2026-110224 | 13 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias… | |
| CVE-2026-110226 | 13 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under… | |
| CVE-2026-110229 | 13 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to… | |
| CVE-2026-110218 | 13 Oct 2026 | CVSS 3.7 | Webkul Aureus ERPAureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts… | |
| CVE-2026-110219 | 13 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price… | |
| CVE-2026-110221 | 13 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes… | |
| CVE-2026-109393 | 12 Oct 2026 | CVSS 6.3 | Webkul QloAppsQloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController… | |
| CVE-2026-107702 | 8 Oct 2026 | CVSS 4.3 | Webkul QloAppsQloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted… | |
| CVE-2026-105836 | 6 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows… | |
| CVE-2026-103587 | 30 Sep 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where… | |
| CVE-2026-103588 | 30 Sep 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form… | |
| CVE-2026-103589 | 30 Sep 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num… | |
| CVE-2026-103590 | 30 Sep 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers… | |
| CVE-2026-101139 | 28 Sep 2026 | CVSS 2.7 | Webkul BagistoA vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file… | |
| CVE-2026-97062 | 24 Sep 2026 | CVSS 5.4 | Webkul Aureus ERPAureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing… |