Webkul vulnerabilities
52 CVEs and advisories name Webkul as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121733Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload
- CVE-2026-115326QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
- CVE-2026-112193Webkul Aureus ERP UserForm.php weak password
- CVE-2026-112190Webkul Aureus ERP composer.json insertion of sensitive information into debugging code
- CVE-2026-111284Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
- CVE-2026-110229QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips
- CVE-2026-110226QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation
- CVE-2026-110224QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors
- CVE-2026-110221QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value
- CVE-2026-110219QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field
- CVE-2026-110218Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL
- CVE-2026-109393QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers
- CVE-2026-107702QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking
- CVE-2026-105836QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms
- CVE-2026-103590QloApps through 1.7.0 Reflected XSS via Length of Stay Fields
- CVE-2026-103589QloApps through 1.7.0 Reflected XSS via Room Type Editor
- CVE-2026-103588QloApps through 1.7.0 Reflected XSS via exceptions field
- CVE-2026-103587QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters
- CVE-2026-101139Webkul Bagisto Invoice Mass Status Update state authorization
- CVE-2026-97062Aureus ERP 1.6.0 Stored XSS via SVG File Upload
- CVE-2026-95655Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
- CVE-2026-94387Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log
- CVE-2026-93988QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
- CVE-2026-93454Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
- CVE-2026-92234QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors
- CVE-2026-89268QloApps through 1.7.0 Reflected XSS via List Filter Parameters
- CVE-2026-75498Webkul QloApps SQL injection
- CVE-2026-75497Webkul QloApps SQL injection
- CVE-2026-75496Webkul QloApps improper file upload validation
- CVE-2026-75082Webkul Bagisto Customer-Registration Notification Email register cross site scripting