Webkul vulnerabilities
We track 17 vulnerabilities in Webkul products across 7 products. 17 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2026.
Latest Webkul vulnerabilities
- 8.1 High severity
Aureus ERP: Authorization Bypass Through User-Controlled Key
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments o
- 7.2 High severity
QloApps: Improper Neutralization of Special Elements used in an SQL Command
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c.
- 7.2 High severity
QloApps: Improper Neutralization of Special Elements used in an SQL Command
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.
- 7.2 High severity
QloApps: Unrestricted Upload of File with Dangerous Type
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve rem
- 8.7 High severity
Bagisto: Improper Limitation of a Pathname to a Restricted Directory
This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename p
- 8.1 High severity
Krayin CRM: Authorization Bypass Through User-Controlled Key
A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a cra
- 8.1 High severity
Krayin CRM: Authorization Bypass Through User-Controlled Key
A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted
- 8.8 High severity
Krayin CRM: Improper Privilege Management
A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.
- 9.8 Critical severity
Qloapps: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
- 8.3 High severity
Bagisto: Improper Neutralization of Input During Web Page Generation
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin use
- 10.0 Critical severity
Medical Prescription Attachment Plugin for…: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medical Prescription Attachment Plugin for WooCommerce medical-prescription-attachment-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Medical Prescript
- 7.2 High severity
QloApps: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_products_list.php. The manipulation of the argument packItself leads to sql injection. The attack can b
- 9.8 Critical severity
WooCommerce Point of Sale: Missing Authorization
The WooCommerce Point of Sale plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0. This is due to insufficient validation on the 'logged_in_user_id' value when option values are empty and the ability for attac
- 9.6 Critical severity
krayin_crm: Improper Neutralization of Input During Web Page Generation
A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malicious payload within the username field. This can lead to privilege escalation when the payload is exec
- 8.8 High severity
krayin_crm: Improper Neutralization of Special Elements Used in a Template Engine
A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation whe
- 9.8 Critical severity
Bundle Product: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the id_product parameters in the UpdateProductQuantity function.
- 7.5 High severity
Qloapps: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication and authorization mechanisms and retrieve the contents of an en