QloApps versions up to 1.7.0 have a path traversal vulnerability in the getEmailHTML action of admin/ajax.php. Authenticated back-office users can exploit this flaw by supplying relative path sequences in the email parameter to read arbitrary files, potentially exposing sensitive information such as database credentials and configuration data.
CVE-2026-93454 is a cross-site scripting (XSS) vulnerability in Webkul Aureus ERP up to version 1.6.0. The vulnerability arises because the Payment Term note field is stored without sanitization and rendered as raw HTML in the Accounting plugin. Authenticated users with permission to create payment terms can inject arbitrary JavaScript, which is then stored and executed in the browsers of users viewing the affected Payment Term record. This vulnerability has a medium severity rating with a CVSS score of 5.1.
QloApps versions up to 1.7.0 contain a cross-site scripting (XSS) vulnerability in the Hotel Reservation System feature management page. This occurs because child feature names are reflected without proper escaping in back-office validation error messages. Authenticated back-office users who click a crafted link can execute injected JavaScript within their administrative session.
QloApps versions up to 1.7.0 contain a cross-site scripting (XSS) vulnerability in the back-office list filter functionality. The application improperly escapes POST parameters rendered into HTML input value attributes, allowing authenticated users to submit crafted requests that execute arbitrary JavaScript. This can lead to unauthorized reading of administrative data and performing actions within the victim's session.
CVE-2026-75498 is a high-severity SQL injection vulnerability in Webkul QloApps. It arises because the application does not validate request parameters before executing database queries. An authenticated attacker with administrative privileges can exploit this by sending a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. The vulnerability allows for full compromise of confidentiality, integrity, and availability of the affected system. A fix has been committed in the codebase (commit 123c97c), but no official patch release or advisory is provided yet.
CVE-2026-75497 is a high-severity SQL injection vulnerability in Webkul QloApps. It arises because the application does not validate request parameters before executing database queries. An authenticated attacker with administrative privileges can exploit this by sending a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. The vulnerability allows full compromise of confidentiality, integrity, and availability of the affected system. A fix has been committed in the codebase (commit 123c97c), but no official patch or advisory is currently provided.
Webkul QloApps contains a vulnerability where it does not properly validate uploaded file extensions or MIME types before placing files in a publicly accessible directory. This flaw allows a remote, authenticated attacker with administrative privileges to upload executable files, potentially leading to remote code execution. The vulnerability is identified as CWE-434 and has a CVSS score of 7.2, indicating high severity. A fix has been implemented in commit 153ec1c, but no explicit vendor advisory or patch release version is provided.
CVE-2026-75082 is a basic cross-site scripting (XSS) vulnerability in Webkul Bagisto affecting versions 2.4.0 through 2.4.4. The flaw exists in the /customer/register component related to Customer-Registration Notification Email, where manipulation of the first_name or last_name parameters can lead to XSS. The vulnerability can be exploited remotely without authentication. The vendor has acknowledged the issue, stating that some fixes have already been implemented internally and remaining fixes are planned for future releases. The CVSS 4.0 score rates this vulnerability as medium severity.
CVE-2026-75081 is a medium severity vulnerability in Webkul Bagisto up to version 2.4.4. It involves manipulation of parameters (rma_qty, resolution_type, rma_reason_id) in the /customer/account/rma/store endpoint, resulting in enforcement of behavioral workflow. The vulnerability can be exploited remotely without user interaction. The vendor has acknowledged the issue, stating some fixes have been applied and others are planned for future releases. No public patch is currently confirmed.
CVE-2026-19997 is an authorization bypass vulnerability in Webkul Bagisto affecting versions 2.4.0 through 2.4.4. The flaw exists in the processing of the /admin/sales/rma/requests endpoint within the Backend Sales RMA component. This vulnerability allows remote attackers with high privileges to bypass authorization controls. The vendor has acknowledged the issue and indicated that some fixes have been implemented internally, with remaining fixes planned for future releases. The CVSS 4.0 score rates this vulnerability as medium severity.
CVE-2026-19996 is a medium severity vulnerability in Webkul Bagisto up to version 2.4.4 involving improper privilege management in the backend customer behavior data endpoint. The flaw allows remote attackers to manipulate an ID argument in the /admin/customers component, potentially leading to unauthorized privilege escalation. The vendor has acknowledged the issue and states that some fixes have already been implemented internally, with remaining fixes planned for upcoming releases. No official patch or public fix is currently confirmed.
A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
CVE-2026-19994 is an authorization bypass vulnerability in Webkul Bagisto affecting versions up to 2.4.4. The flaw exists in the /admin/configuration/cache-management/execute component, where manipulation of the 'action' argument allows unauthorized access. The vulnerability can be exploited remotely. The vendor has acknowledged the issue, stating it was identified internally and is being addressed in ongoing development cycles, with some fixes already applied and others planned for future releases.
A vulnerability has been found in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the file /customer/account/rma/update-status of the component RMA State Validation. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search. Executing a manipulation of the argument Query can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."