Threats affecting pkg:github/QloApps

22 threats

Severity	CVSS	Signals	Threat	Source	Published
Critical	9.8	EPSS 0.9%	CVE-2025-67325QloApps · Unrestricted File Upload Critical9.8EPSS 0.9%2026-01-08CVE Database V5CVE-2025-67325 Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution. EPSS 0.9%Vulnerability CWE-434	CVE Database V5	2026-01-08
Medium	5.1	EPSS 0.6%	CVE-2025-6173Webkul QloApps · SQL Injection Medium5.1EPSS 0.6%2025-06-17CVE Database V5CVE-2025-6173 A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_products_list.php. The manipulation of the argument packItself leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this flaw but considers it a low-level issue due to admin privilege pre-requisites. Still, a fix is planned for a future release. EPSS 0.6%Vulnerability	CVE Database V5	2025-06-17
High	7.2	EPSS 1.2%	CVE-2024-40318qloapps · An Arbitrary File Upload High7.2EPSS 1.2%2024-07-25CVE Database V5CVE-2024-40318 An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file. EPSS 1.2%Vulnerability CWE-434	CVE Database V5	2024-07-25
Medium	6.5	EPSS 0.7%	CVE-2023-36235webkul qloapps · Insecure Direct Object Reference Medium6.5EPSS 0.7%2024-01-17CVE Database V5CVE-2023-36235 An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter. EPSS 0.7%Vulnerability CWE-639	CVE Database V5	2024-01-17

Page 2 of 2