Webkul
10 CVEs across 12 Webkul products. Browse Webkul vulnerabilities, severities, and proof-of-concept exploits.
Webkul products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19838 | Medium | 4.3 | 2026-08-14 | A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the co… |
CVE-2026-19837 | Low | 2.7 | 2026-08-14 | A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search… |
CVE-2026-19836 | Medium | 4.3 | 2026-08-14 | A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of th… |
CVE-2026-19835 | Low | 3.8 | 2026-08-14 | A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletio… |
CVE-2026-19834 | Medium | 4.7 | 2026-08-14 | A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component… |
CVE-2026-60120 | Medium | 5.4 | 2026-07-09 | Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute a… |
CVE-2017-20262 | High | 8.2 | 2026-06-19 | Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mal… |
CVE-2026-9506 | | 2026-06-08 | This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacke… | |
CVE-2026-38532 | High | 8.1 | 2026-04-14 | A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to… |
CVE-2026-38530 | High | 8.1 | 2026-04-14 | A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to a… |
CVE-2026-38529 | High | 8.8 | 2026-04-14 | A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrari… |
CVE-2021-41074 | Medium | 5.4 | 2026-01-12 | A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document. |
CVE-2025-67325 | Critical | 9.8 | 2026-01-08 | Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execu… |
CVE-2026-21451 | High | 8.4 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CM… |
CVE-2026-21450 | Critical | 9.8 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can l… |
CVE-2026-21449 | High | 8.8 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name fr… |
CVE-2026-21448 | Critical | 9.8 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders… |
CVE-2026-21447 | High | 7.1 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder… |
CVE-2026-21446 | Critical | 9.8 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation i… |
CVE-2025-62418 | Medium | 6.9 | 2025-10-16 | Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (… |
CVE-2025-62417 | High | 7.8 | 2025-10-16 | Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepte… |
CVE-2025-62416 | Medium | 5.1 | 2025-10-16 | Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being… |
CVE-2025-62415 | Medium | 6.9 | 2025-10-16 | Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (… |
CVE-2025-62414 | Medium | 6.9 | 2025-10-16 | Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scr… |
CVE-2025-60880 | High | 8.3 | 2025-10-10 | An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file co… |
CVE-2025-56426 | Medium | 6.5 | 2025-10-09 | An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logi… |
CVE-2025-10759 | Medium | 5.3 | 2025-09-21 | A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of th… |
CVE-2025-55745 | High | 8.8 | 2025-08-22 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Versions 0.3.0 and prior are vulnerable to CSV injection… |
CVE-2025-55741 | High | 8.1 | 2025-08-22 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete pr… |
CVE-2025-55744 | Medium | 4.3 | 2025-08-21 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, some of the endpoints of the application is… |
CVE-2025-55743 | High | 8.8 | 2025-08-21 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, the image upload at the user creation featur… |
CVE-2025-55742 | High | 8.0 | 2025-08-21 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scriptin… |
CVE-2025-29009 | Critical | 10.0 | 2025-07-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medical Prescription Attachment Plugin for WooCommerce medical-prescription-attachment-… |
CVE-2025-6173 | Medium | 4.7 | 2025-06-17 | A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_pr… |
CVE-2025-40675 | Medium | 6.1 | 2025-06-09 | A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the… |
CVE-2025-3568 | Low | 3.5 | 2025-04-14 | A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-26058 | Medium | 4.2 | 2025-02-18 | Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application app… |
CVE-2025-1155 | Medium | 4.3 | 2025-02-10 | A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the component Your… |
CVE-2025-1074 | Medium | 4.3 | 2025-02-06 | A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the compo… |
CVE-2024-11281 | Critical | 9.8 | 2024-12-25 | The WooCommerce Point of Sale plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0. This is due to insufficie… |
CVE-2024-52305 | Medium | 6.5 | 2024-11-13 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability exists in the Create User process, allowin… |
CVE-2024-50637 | Medium | 5.4 | 2024-11-06 | UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. This allows attackers to perform XSS via an SVG document, which… |
CVE-2024-45932 | Medium | 4.8 | 2024-10-07 | Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2. |
CVE-2024-46367 | Critical | 9.6 | 2024-09-27 | A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malici… |
CVE-2024-46366 | High | 8.8 | 2024-09-27 | A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by inje… |
CVE-2024-40318 | High | 7.2 | 2024-07-25 | An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2023-36238 | Medium | 6.5 | 2024-03-13 | Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter. |
CVE-2024-27499 | Medium | 6.5 | 2024-03-01 | Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. |
CVE-2023-36237 | High | 8.8 | 2024-02-26 | Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script. |
CVE-2023-51210 | Critical | 9.8 | 2024-01-23 | SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the id_product parameters in the UpdateProduc… |
CVE-2023-36235 | Medium | 6.5 | 2024-01-17 | An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter. |
CVE-2023-36236 | Medium | 4.8 | 2024-01-16 | Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad. |
CVE-2023-37636 | Medium | 5.4 | 2023-10-23 | A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2023-39147 | High | 7.8 | 2023-08-01 | An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file. |
CVE-2023-33570 | High | 8.8 | 2023-06-28 | Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). |
CVE-2023-36287 | Medium | 6.1 | 2023-06-23 | An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then imperso… |
CVE-2023-36284 | High | 7.5 | 2023-06-23 | An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypa… |
CVE-2023-36289 | Medium | 6.1 | 2023-06-23 | An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then imperso… |
CVE-2023-36288 | Medium | 5.4 | 2023-06-23 | An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then imperso… |
CVE-2023-2925 | Low | 2.4 | 2023-05-27 | A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4. This affects an unknown part of the file /admin/contacts/organizati… |
CVE-2023-30256 | Medium | 6.1 | 2023-05-11 | Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create param… |
CVE-2021-41924 | Medium | 6.1 | 2022-06-21 | Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS). |
CVE-2019-16403 | High | 8.8 | 2019-09-18 | In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by… |
CVE-2019-14933 | High | 8.8 | 2019-08-11 | Bagisto 0.1.5 allows CSRF under /admin URIs. |
CVE-2010-1659 | | 2010-05-03 | Directory traversal vulnerability in the Ultimate Portfolio (com_ultimateportfolio) component 1.0 for Joomla! allows remote attackers to read arbitrary files v… |