QloApps vulnerabilities
6 known vulnerabilities in QloApps from Webkul. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
QloApps: Improper Neutralization of Special Elements used in an SQL Command
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c.
- 7.2 High severity
QloApps: Improper Neutralization of Special Elements used in an SQL Command
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.
- 7.2 High severity
QloApps: Unrestricted Upload of File with Dangerous Type
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve rem
- 9.8 Critical severity
Qloapps: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
- 7.2 High severity
QloApps: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_products_list.php. The manipulation of the argument packItself leads to sql injection. The attack can b
- 7.5 High severity
Qloapps: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication and authorization mechanisms and retrieve the contents of an en