Priority HIGH 82
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00905 · Published 2026-01-08 · No fix listed CWE-434
Priority HIGH 77
Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cid parameter.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00492 · Published 2026-06-19 · No fix listed CWE-89
Priority HIGH 74
Bagisto is an open source laravel eCommerce platform.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00916 · Published 2026-01-02 · Fixed in 2.3.10 CWE-1336
Priority HIGH 73
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0105 · Published 2023-06-28 · No fix listed CWE-94
Priority HIGH 72
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and M…
CVSS 4.0HIGH 8.6· Network · High privileges · No interaction · EPSS 0.00626 · Published 2026-09-02 · Fixed in 2.1.5 CWE-434
Priority HIGH 72
Webkul QloApps does not validate request parameters before a database query.
CVSS 4.0HIGH 8.6· Network · High privileges · No interaction · EPSS 0.00807 · Published 2026-08-25 · Fixed in 123c97c CWE-89
Priority HIGH 72
Webkul QloApps does not validate request parameters before a database query.
CVSS 4.0HIGH 8.6· Network · High privileges · No interaction · EPSS 0.00807 · Published 2026-08-25 · Fixed in 123c97c CWE-89
Priority HIGH 72
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory.
CVSS 4.0HIGH 8.6· Network · High privileges · No interaction · EPSS 0.00981 · Published 2026-08-25 · Fixed in 153ec1c CWE-434
Priority HIGH 72
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication and authorization mecha…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03157 · Published 2023-06-23 · No fix listed CWE-89
Priority HIGH 70
A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00302 · Published 2026-10-19 · No fix listed CWE-200
Priority HIGH 70
Bagisto is an open source laravel eCommerce platform.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00304 · Published 2026-01-02 · Fixed in 2.3.10 CWE-284
Priority HIGH 70
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00442 · Published 2025-08-22 · Fixed in 0.3.1 CWE-284
Priority HIGH 70
A vulnerability was detected in Webkul QloApps up to 1.7.0.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00347 · Published 2025-09-21 · No fix listed CWE-285
Priority HIGH 69
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code.
CVSS 3.1HIGH 8.3· Network · High privileges · User interaction · EPSS 0.0041 · Published 2025-10-10 · Fixed in 2.3.7 CWE-79
Priority HIGH 69
An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0123 · Published 2023-08-01 · No fix listed CWE-434
Priority HIGH 68
Bagisto is an open source laravel eCommerce platform.
CVSS 4.0HIGH 7.4· Network · Low privileges · No interaction · EPSS 0.00504 · Published 2026-01-02 · Fixed in 2.3.10 CWE-1336
Priority HIGH 68
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.00385 · Published 2025-08-21 · Fixed in 0.2.1 CWE-79
Priority HIGH 68
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00197 · Published 2024-11-13 · Fixed in 0.1.5 CWE-616
Priority HIGH 67
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01183 · Published 2024-07-25 · No fix listed CWE-434
Priority HIGH 66
Bagisto is an open source laravel eCommerce platform.
CVSS 4.0HIGH 7.1· Local · No auth · User interaction · EPSS 0.00392 · Published 2025-10-16 · Fixed in 2.3.8 CWE-1236
Priority HIGH 65
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework.
CVSS 4.0HIGH 7.3· Network · High privileges · No interaction · EPSS 0.00478 · Published 2025-08-21 · Fixed in 0.2.1 CWE-434
Priority MEDIUM 64
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00551 · Published 2026-09-19 · No fix listed CWE-22
Priority MEDIUM 64
UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00417 · Published 2026-09-03 · Fixed in 2.1.3 CWE-862
Priority MEDIUM 64
Bagisto is an open source laravel eCommerce platform.
CVSS 3.1MEDIUM 6.9· Network · High privileges · User interaction · EPSS 0.0028 · Published 2025-10-16 · Fixed in 2.3.8 CWE-80
Priority MEDIUM 64
Bagisto is an open source laravel eCommerce platform.
CVSS 3.1MEDIUM 6.9· Network · High privileges · User interaction · EPSS 0.0028 · Published 2025-10-16 · Fixed in 2.3.8 CWE-80
Load more
THREATIST.IORead the docs