W
Vendor security profile
webkul
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs38
Critical0
CISA KEV0
Public exploit25
Patch rate%55
Avg. CVSS5.6
12-month vulnerability rate
0
0
0
0
0
0
0
1
0
15
12
9
CVE KEV
CVE severity distribution
38toplam CVE
High6 (16%)
Medium32 (84%)
Patch and exploitation view
%55
Verified patch
%0
CISA KEV
%66
Public exploit
21Patch available
0Partial
0Workaround
0Vendor: no patch
17Unknown
Latest vulnerabilities
5.3
CVE-2026-110229
QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips
W
Patch verified
5.3
CVE-2026-110226
QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation
W
Patch verified
5.1
CVE-2026-110224
QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors
W
Patch status unknown
5.1
CVE-2026-110221
QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value
W
Patch status unknown
5.1
CVE-2026-110219
QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field
W
Patch verified
6.3
CVE-2026-110218
Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL
W
Patch status unknown
5.3
CVE-2026-109393
QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers
W
Patch verifiedEPSS %0
5.3
CVE-2026-107702
QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking
W
Patch verifiedEPSS %0
5.3
CVE-2026-105836
QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms
W
Patch verifiedEPSS %0
5.1
CVE-2026-103590
QloApps through 1.7.0 Reflected XSS via Length of Stay Fields
W
Patch verifiedEPSS %0