Qloapps
by QloApps
Source repositories
CVEs (20)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-67325 | Cri | 0.64 | 9.8 | 0.01 | Jan 8, 2026 | Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution. | ||
| CVE-2026-75497 | Hig | 0.40 | 7.2 | 0.01 | Aug 25, 2026 | Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c. | ||
| CVE-2026-75496 | Hig | 0.40 | 7.2 | 0.01 | Aug 25, 2026 | Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution.… | ||
| CVE-2026-93988 | Med | 0.35 | 6.5 | 0.01 | Sep 19, 2026 | QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions… | ||
| CVE-2026-109393 | Med | 0.34 | 6.3 | 0.00 | Oct 12, 2026 | QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htl_access hotel checks. Hotel-restricted… | ||
| CVE-2026-25558 | Med | 0.31 | 4.8 | 0.00 | Jun 8, 2026 | QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG… | ||
| CVE-2026-25861 | Med | 0.31 | 5.9 | 0.00 | Jun 2, 2026 | QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which… | ||
| CVE-2026-110229 | Med | 0.28 | 5.4 | 0.00 | Oct 13, 2026 | QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from… | ||
| CVE-2026-110226 | Med | 0.28 | 5.4 | 0.00 | Oct 13, 2026 | QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room type form selector… | ||
| CVE-2026-110224 | Med | 0.28 | 5.4 | 0.00 | Oct 13, 2026 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted… | ||
| CVE-2026-110221 | Med | 0.28 | 5.4 | 0.00 | Oct 13, 2026 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature_price_name and impact_value POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into… | ||
| CVE-2026-110219 | Med | 0.28 | 5.4 | 0.00 | Oct 13, 2026 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted… | ||
| CVE-2026-105836 | Med | 0.28 | 5.4 | 0.00 | Oct 6, 2026 | QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id_rooms parameter to… | ||
| CVE-2026-103590 | Med | 0.28 | 5.4 | 0.00 | Sep 30, 2026 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restriction_min_los and… | ||
| CVE-2026-103589 | Med | 0.28 | 5.4 | 0.00 | Sep 30, 2026 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST… | ||
| CVE-2026-103588 | Med | 0.28 | 5.4 | 0.00 | Sep 30, 2026 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated… | ||
| CVE-2026-103587 | Med | 0.28 | 5.4 | 0.00 | Sep 30, 2026 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where date_to and id_room_type parameters are copied into template variables without validation. Attackers can craft a malicious link… | ||
| CVE-2026-92234 | Med | 0.28 | 5.4 | 0.00 | Sep 15, 2026 | QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative… | ||
| CVE-2026-89268 | Med | 0.28 | 5.4 | 0.00 | Sep 12, 2026 | QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers,… | ||
| CVE-2026-107702 | Med | 0.21 | 4.3 | 0.00 | Oct 8, 2026 | QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter… |
- risk 0.64cvss 9.8epss 0.01
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
- risk 0.40cvss 7.2epss 0.01
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.
- risk 0.40cvss 7.2epss 0.01
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution.…
- risk 0.35cvss 6.5epss 0.01
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions…
- risk 0.34cvss 6.3epss 0.00
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htl_access hotel checks. Hotel-restricted…
- risk 0.31cvss 4.8epss 0.00
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG…
- risk 0.31cvss 5.9epss 0.00
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which…
- risk 0.28cvss 5.4epss 0.00
QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from…
- risk 0.28cvss 5.4epss 0.00
QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room type form selector…
- risk 0.28cvss 5.4epss 0.00
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted…
- risk 0.28cvss 5.4epss 0.00
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature_price_name and impact_value POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into…
- risk 0.28cvss 5.4epss 0.00
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted…
- risk 0.28cvss 5.4epss 0.00
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id_rooms parameter to…
- risk 0.28cvss 5.4epss 0.00
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restriction_min_los and…
- risk 0.28cvss 5.4epss 0.00
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST…
- risk 0.28cvss 5.4epss 0.00
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated…
- risk 0.28cvss 5.4epss 0.00
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where date_to and id_room_type parameters are copied into template variables without validation. Attackers can craft a malicious link…
- risk 0.28cvss 5.4epss 0.00
QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative…
- risk 0.28cvss 5.4epss 0.00
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers,…
- risk 0.21cvss 4.3epss 0.00
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter…