Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: QloApps Clear all filters
TI-2026-80955 CVE-2026-116746 · GHSA-r73j-mrwx-7crw

Missing authorization in QloApps qlohotelreview lets attackers post fake reviews

Priority LOW 36

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0025 Published 2026-10-26 No fix listed CWE-639
TI-2026-80954 CVE-2026-116745 · GHSA-g7m3-95cx-3cxg

Guest order disclosure via id_cart in QloApps order confirmation

Priority LOW 36

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart v…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00226 Published 2026-10-26 No fix listed CWE-639
TI-2026-20665 CVE-2026-25558 · GHSA-xcx6-j7v3-9h57

QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager

Priority MEDIUM 55

QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.0023 Published 2026-06-08 No fix listed CWE-79
TI-2026-20905 CVE-2026-25861 · GHSA-xcxp-3whg-h83c

QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php

Priority LOW 35

QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::e…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00178 Published 2026-06-02 No fix listed CWE-916