CVE-2025-10759mediumCWE-285CWE-639

CVE-2025-10759: fallo de gravedad media en Webkul QloApps

Webkul QloApps CSRF Token authorization

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear QloApps

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.9epss 0.3%
A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of the argument token results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. The vendor explains: "As We are already aware about this vulnerability and our Internal team are already working on this issue. (...) We'll implement the fix for this vulnerability in our next major release."
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
Webkul · QloApps
CVEs relacionadas — Webkul QloApps

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-75496HIGHWebkul QloApps improper file upload validationEPSS 1.0%CVE-2026-75498HIGHWebkul QloApps SQL injectionEPSS 0.8%CVE-2026-75497HIGHWebkul QloApps SQL injectionEPSS 0.8%CVE-2025-6173MEDIUMWebkul QloApps ajax_products_list.php sql injectionEPSS 0.6%CVE-2025-1155MEDIUMWebkul QloApps Your Location Search stores cross site scriptingEPSS 0.5%CVE-2026-107702MEDIUMQloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room BookingEPSS 0.3%