CVE Feed

    Dashboard / CVE / CVE-2025-1155

    CVE-2025-1155

    A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the component Your Location Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. It is planned to remove this page in the long term.

    Published:Feb 10, 2025
    Last Modified:Jun 20, 2025
    EPS:Feb 10, 2025
    EPSS Score:0.00053
    CVSS Score:4.3

    Affected Products

    Vendor
    Webkul
    Product
    Qloapps

    Exploits

    https://github.com/mano257200/Qloapp-XSS-Vulnerability/tree/mainhttps://github.com/mano257200/Qloapp-XSS-Vulnerability/tree/main

    Related CVEs

    CVE-2026-75498 (CVSS 8.6) — Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker …
    CVE-2026-75497 (CVSS 8.6) — Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker …
    CVE-2026-75496 (CVSS 8.6) — Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the …
    CVE-2026-25558 (CVSS 4.8) — QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allo…
    CVE-2026-25861 (CVSS 8.2) — QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that all…
    CVE-2021-41074 (CVSS 5.4) — A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email addr…
    CVE-2025-67325 (CVSS 9.8) — Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unaut…
    CVE-2025-10759 (CVSS 5.5) — A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component …
    CVE-2025-6173 (CVSS 2) — A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an…
    CVE-2025-26058 (CVSS 4.2) — Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin pa…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High