# cve.now: Webkul

The newest entries naming Webkul as an affected vendor (up to 200), of 52 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121733](https://cve.now/CVE-2026-121733.md): Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload (CVSS 2.1)
- [CVE-2026-115326](https://cve.now/CVE-2026-115326.md): QloApps through 1.7.0 IDOR via OrderDetailController Refund Request (CVSS 5.3)
- [CVE-2026-112193](https://cve.now/CVE-2026-112193.md): Webkul Aureus ERP UserForm.php weak password (CVSS 6.3)
- [CVE-2026-112190](https://cve.now/CVE-2026-112190.md): Webkul Aureus ERP composer.json insertion of sensitive information into debugging code (CVSS 6.9)
- [CVE-2026-111284](https://cve.now/CVE-2026-111284.md): Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal (CVSS 5.1)
- [CVE-2026-110229](https://cve.now/CVE-2026-110229.md): QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips (CVSS 5.3)
- [CVE-2026-110226](https://cve.now/CVE-2026-110226.md): QloApps through 1.7.0 Authorization Bypass via id\_hotel in Room Type Creation (CVSS 5.3)
- [CVE-2026-110224](https://cve.now/CVE-2026-110224.md): QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors (CVSS 5.1)
- [CVE-2026-110221](https://cve.now/CVE-2026-110221.md): QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value (CVSS 5.1)
- [CVE-2026-110219](https://cve.now/CVE-2026-110219.md): QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field (CVSS 5.1)
- [CVE-2026-110218](https://cve.now/CVE-2026-110218.md): Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL (CVSS 6.3)
- [CVE-2026-109393](https://cve.now/CVE-2026-109393.md): QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers (CVSS 5.3)
- [CVE-2026-107702](https://cve.now/CVE-2026-107702.md): QloApps through 1.7.0 Authorization Bypass via id\_hotel in Admin Room Booking (CVSS 5.3)
- [CVE-2026-105836](https://cve.now/CVE-2026-105836.md): QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms (CVSS 5.3)
- [CVE-2026-103590](https://cve.now/CVE-2026-103590.md): QloApps through 1.7.0 Reflected XSS via Length of Stay Fields (CVSS 5.1)
- [CVE-2026-103589](https://cve.now/CVE-2026-103589.md): QloApps through 1.7.0 Reflected XSS via Room Type Editor (CVSS 5.1)
- [CVE-2026-103588](https://cve.now/CVE-2026-103588.md): QloApps through 1.7.0 Reflected XSS via exceptions field (CVSS 5.1)
- [CVE-2026-103587](https://cve.now/CVE-2026-103587.md): QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters (CVSS 5.1)
- [CVE-2026-101139](https://cve.now/CVE-2026-101139.md): Webkul Bagisto Invoice Mass Status Update state authorization (CVSS 5.1)
- [CVE-2026-97062](https://cve.now/CVE-2026-97062.md): Aureus ERP 1.6.0 Stored XSS via SVG File Upload (CVSS 5.1)
- [CVE-2026-95655](https://cve.now/CVE-2026-95655.md): Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel (CVSS 8.6)
- [CVE-2026-94387](https://cve.now/CVE-2026-94387.md): Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log (CVSS 5.1)
- [CVE-2026-93988](https://cve.now/CVE-2026-93988.md): QloApps through 1.7.0 Arbitrary File Read via getEmailHTML (CVSS 7.1)
- [CVE-2026-93454](https://cve.now/CVE-2026-93454.md): Aureus ERP through 1.6.0 Stored XSS via Payment Term Note (CVSS 5.1)
- [CVE-2026-92234](https://cve.now/CVE-2026-92234.md): QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors (CVSS 5.1)
- [CVE-2026-89268](https://cve.now/CVE-2026-89268.md): QloApps through 1.7.0 Reflected XSS via List Filter Parameters (CVSS 5.1)
- [CVE-2026-75498](https://cve.now/CVE-2026-75498.md): Webkul QloApps SQL injection (CVSS 7.2)
- [CVE-2026-75497](https://cve.now/CVE-2026-75497.md): Webkul QloApps SQL injection (CVSS 7.2)
- [CVE-2026-75496](https://cve.now/CVE-2026-75496.md): Webkul QloApps improper file upload validation (CVSS 7.2)
- [CVE-2026-75082](https://cve.now/CVE-2026-75082.md): Webkul Bagisto Customer-Registration Notification Email register cross site scripting (CVSS 5.3)
- [CVE-2026-75081](https://cve.now/CVE-2026-75081.md): Webkul Bagisto store behavioral workflow (CVSS 5.3)
- [CVE-2026-19997](https://cve.now/CVE-2026-19997.md): Webkul Bagisto Backend Sales RMA Endpoint requests authorization (CVSS 5.1)
- [CVE-2026-19996](https://cve.now/CVE-2026-19996.md): Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management (CVSS 5.3)
- [CVE-2026-19995](https://cve.now/CVE-2026-19995.md): Webkul Bagisto RMA Message send-message cross site scripting (CVSS 5.1)
- [CVE-2026-19994](https://cve.now/CVE-2026-19994.md): Webkul Bagisto Configuration Management execute authorization (CVSS 5.3)
- [CVE-2026-19993](https://cve.now/CVE-2026-19993.md): Webkul Bagisto RMA State Validation update-status behavioral workflow (CVSS 5.3)
- [CVE-2026-19838](https://cve.now/CVE-2026-19838.md): Webkul Bagisto Backend Reporting Endpoint sales authorization (CVSS 5.3)
- [CVE-2026-19837](https://cve.now/CVE-2026-19837.md): Webkul Bagisto Customer Search search information disclosure (CVSS 5.1)
- [CVE-2026-19836](https://cve.now/CVE-2026-19836.md): Webkul Bagisto Backend Customer Detail Feature view authorization (CVSS 5.3)
- [CVE-2026-19835](https://cve.now/CVE-2026-19835.md): Webkul Bagisto Customer Item Deletion Endpoint access control (CVSS 5.1)
- [CVE-2026-19834](https://cve.now/CVE-2026-19834.md): Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization (CVSS 5.1)
- [CVE-2026-60120](https://cve.now/CVE-2026-60120.md): Bagisto \< 2.4.4 Stored XSS via CSTI in create.blade.php (CVSS 5.1)
- [CVE-2017-20262](https://cve.now/CVE-2017-20262.md): Joomla! Component Ajax Quiz 1.8 SQL Injection (CVSS 8.8)
- [CVE-2026-9506](https://cve.now/CVE-2026-9506.md): Path Traversal Vulnerability in Bagisto (CVSS 8.7)
- [CVE-2025-10759](https://cve.now/CVE-2025-10759.md): Webkul QloApps CSRF Token authorization (CVSS 6.9)
- [CVE-2025-29009](https://cve.now/CVE-2025-29009.md): WordPress Medical Prescription Attachment Plugin for WooCommerce \<= 1.2.3 - Arbitrary File Upload Vulnerability (CVSS 10.0)
- [CVE-2025-6173](https://cve.now/CVE-2025-6173.md): Webkul QloApps ajax\_products\_list.php sql injection (CVSS 5.1)
- [CVE-2025-3568](https://cve.now/CVE-2025-3568.md): Webkul Krayin CRM SVG File edit cross site scripting (CVSS 5.1)
- [CVE-2025-1155](https://cve.now/CVE-2025-1155.md): Webkul QloApps Your Location Search stores cross site scripting (CVSS 5.3)
- [CVE-2025-1074](https://cve.now/CVE-2025-1074.md): Webkul QloApps URL mylogout cross-site request forgery (CVSS 5.3)
- [CVE-2024-11281](https://cve.now/CVE-2024-11281.md): WooCommerce Point of Sale \<= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change (CVSS 9.8)
- [CVE-2023-2925](https://cve.now/CVE-2023-2925.md): Webkul krayin crm Edit Person Page 2 cross site scripting (CVSS 2.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/webkul
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.