Webkul QloApps

7 known vulnerabilities in Webkul QloApps, with patch priority, exploit likelihood and the news covering them.

Latest vulnerabilities

  • CVE-2026-103590 CVSS 5.1 medium QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields…
  • CVE-2026-103589 CVSS 5.1 medium QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape…
  • CVE-2026-103588 CVSS 5.1 medium QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a…
  • CVE-2026-103587 CVSS 5.1 medium QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search…
  • CVE-2026-93988 CVSS 7.1 high QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated…
  • CVE-2026-92234 CVSS 5.1 medium QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System…
  • CVE-2026-89268 CVSS 5.1 medium QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list…