Threat database

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.

A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak password requirements. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Aureus ERP versions up to 1.6.0 have a stored cross-site scripting (XSS) vulnerability in the HolidayAction.php component. Authenticated users with permission to create Public Holidays or Mandatory Days can inject malicious JavaScript via unescaped holiday names. This script executes when HR managers or administrators open the Holiday modal, potentially allowing session hijacking.

QloApps versions up to 1.7.0 have an improper access control vulnerability in the AdminSlipController. This flaw allows hotel-restricted back-office employees to access credit slips belonging to other hotels. Exploitation enables attackers to list, export, mark as redeemed, and generate store-credit vouchers from refund records of other hotels, exposing sensitive customer information such as identities and refund amounts.

QloApps versions up to 1.7.0 have a broken access control vulnerability allowing hotel-restricted back-office employees to create room types under hotels they are not assigned to by manipulating the hotel ID parameter. This enables unauthorized creation of rooms and inventory for other hotels via the AdminProductsController. The vulnerability has a medium severity with a CVSS score of 5.3.

QloApps versions up to and including 1.7.0 have a reflected cross-site scripting (XSS) vulnerability in the AdminSearchConfController::processSave() function. This flaw occurs because rejected alias and search values are echoed back unescaped in validation error messages. An attacker can exploit this by tricking an authenticated back-office user into submitting a specially crafted request, leading to execution of arbitrary JavaScript in the administrative session.

QloApps versions up to 1.7.0 have a reflected cross-site scripting (XSS) vulnerability in the AdminHotelFeaturePricesSettings form. This flaw occurs because the application echoes certain POST parameters without proper escaping after validation failure. An attacker can exploit this by tricking an authenticated back-office user into submitting a crafted request, leading to JavaScript execution in the admin session.

QloApps versions up to 1.7.0 contain a reflected cross-site scripting (XSS) vulnerability in the back-office Additional Facilities form. This flaw allows remote attackers to inject malicious scripts via the price parameter. When an authenticated back-office user submits a crafted request with an unescaped price value that fails validation, the injected JavaScript executes in their administrative session.

Aureus ERP versions up to 1.6.0 have an authorization bypass vulnerability that allows unauthenticated attackers to access unpublished draft blog posts. Attackers who know or guess the post slug can retrieve sensitive blog post details such as title, content, image, tags, author, and publish date because the application does not properly enforce authorization checks on the post view page.

QloApps versions up to 1.7.0 have an insecure direct object reference vulnerability in several back-office AJAX handlers. This flaw allows hotel-restricted employees to bypass hotel access checks by supplying other hotels' identifiers, enabling unauthorized reading, uploading, and deletion of booking documents, as well as deletion of rooms and images.

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter on the Book Now page to view room availability and booking status of hotels outside their assigned profile access.

QloApps versions up to 1.7.0 have an authorization bypass vulnerability in the AdminProductsController::ajaxProcessBulkUpdateRooms function. This flaw allows hotel-restricted back-office employees to modify rooms belonging to other hotels by submitting foreign room IDs. The unauthorized changes can affect room status, floor, comments, or inactive dates, potentially disrupting room availability and bookings.

QloApps versions up to and including 1.7.0 have a reflected cross-site scripting (XSS) vulnerability in the back-office room type editor's length of stay fields. Authenticated administrators can be tricked into submitting crafted POST requests with malicious JavaScript payloads in the restriction_min_los and restriction_max_los parameters, leading to script execution within their administrative session.

QloApps versions up to 1.7.0 contain a reflected cross-site scripting (XSS) vulnerability in the back-office room type editor. The vulnerability arises because the application does not properly escape certain input fields (room_num, floor, comment) in HTML input attributes. Authenticated back-office users can be tricked into submitting malicious POST requests that execute arbitrary JavaScript in their administrative sessions. This vulnerability has a medium severity rating with a CVSS score of 5.1.

QloApps versions up to 1.7.0 contain a reflected cross-site scripting (XSS) vulnerability in the back-office Transplant a module form's exceptions field. An attacker can craft a malicious URL with a JavaScript payload in the exceptions parameter that executes in an authenticated administrator's session when clicked. This vulnerability requires the victim to be an authenticated administrator and to interact with the malicious link.

QloApps versions up to 1.7.0 have a reflected cross-site scripting (XSS) vulnerability in the back-office Hotel Reservation System Book Now search feature. The vulnerability arises because the date_to and id_room_type parameters are inserted into template variables without proper validation. An attacker can craft a malicious URL containing JavaScript payloads in these parameters, which executes in an authenticated administrator's session if the link is followed.

A vulnerability in Webkul Aureus ERP versions up to 1.6.0 allows authenticated users to upload malicious SVG files containing JavaScript. These files are stored on a public disk and served from the application origin, enabling script execution when the SVG file URL is accessed. This can lead to session cookie theft and CSRF token exfiltration. The issue is fixed in a commit identified as 53ad76d.

CVE-2026-95655 is a high-severity authorization bypass vulnerability in Webkul Aureus ERP versions before 1.5.0. The flaw allows authenticated users to access, modify, or delete arbitrary messages across departments or companies by exploiting improper scoping of message lookups in the ChatterPanel. Attackers can enumerate all notes in the system by submitting sequential message IDs.

CVE-2026-94387 is a stored cross-site scripting (XSS) vulnerability in Webkul Aureus ERP versions before 1.6.0. The flaw exists in the Chatter field-change log where old_value and new_value entries are not properly escaped. This allows users with permission to edit tracked text fields to inject malicious markup that executes when other users view the Chatter panel, including administrators.