3 results (0.003 seconds)

CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1

CVE-2025-6173 – Webkul QloApps ajax_products_list.php sql injection

https://notcve.org/view.php?id=CVE-2025-6173

17 Jun 2025 — A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_products_list.php. The manipulation of the argument packItself leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/caigo8/CVE-md/blob/main/QloApps/SQL_Injection.md • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2025-1155 – Webkul QloApps Your Location Search stores cross site scripting

https://notcve.org/view.php?id=CVE-2025-1155

10 Feb 2025 — A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the component Your Location Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. It is planned to remove this page in the long term. • https://github.com/mano257200/Qloapp-XSS-Vulnerability/tree/main • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1

CVE-2025-1074 – Webkul QloApps URL mylogout cross-site request forgery

https://notcve.org/view.php?id=CVE-2025-1074

06 Feb 2025 — A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the component URL Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. • https://github.com/mano257200/qloapps-csrf-logout-vulnerability • CWE-352: Cross-Site Request Forgery (CSRF) CWE-862: Missing Authorization •