CVE-2026-89268mediumCWE-79

CVE-2026-89268: falha de média gravidade em Webkul QloApps

QloApps through 1.7.0 Reflected XSS via List Filter Parameters

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar QloApps

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.3%
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
Webkul · QloApps
CVEs relacionadas — Webkul QloApps

No mesmo produto, das mais perigosas para as menos.

CVE-2026-75496HIGHWebkul QloApps improper file upload validationEPSS 1.0%CVE-2026-75498HIGHWebkul QloApps SQL injectionEPSS 0.8%CVE-2026-75497HIGHWebkul QloApps SQL injectionEPSS 0.8%CVE-2025-6173MEDIUMWebkul QloApps ajax_products_list.php sql injectionEPSS 0.6%CVE-2025-1155MEDIUMWebkul QloApps Your Location Search stores cross site scriptingEPSS 0.5%CVE-2025-10759MEDIUMWebkul QloApps CSRF Token authorizationEPSS 0.3%