Browse CVEs

HIGH 8.2 CVE-2017-20262 Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by inj… Ajax Quiz No fix yet Fix from $1,9502026-06-19 HIGH 8.8 CVE-2026-38529 A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to… Krayin Crm No fix yet Fix from $1,9502026-04-14 HIGH 8.1 CVE-2026-38530 A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated atta… Krayin Crm No fix yet Fix from $1,9502026-04-14 HIGH 8.1 CVE-2026-38532 A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated att… Krayin Crm No fix yet Fix from $1,9502026-04-14 MEDIUM 5.4 CVE-2021-41074 A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document. Qloapps Mitigation only Fix from $1,6002026-01-12 HIGH 7.8 CVE-2025-62417 Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula character (for example =, +, -, or @) … Bagisto No fix yet Fix from $1,9502025-10-16 MEDIUM 6.8 CVE-2025-62416 Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user i… Bagisto No fix yet Fix from $1,6002025-10-16 HIGH 8.3 CVE-2025-60880 An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted S… Bagisto No fix yet Fix from $1,9502025-10-10 MEDIUM 6.5 CVE-2025-56426 An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calcul… Bagisto No fix yet Fix from $1,6002025-10-09 HIGH 7.2 CVE-2025-6173 A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /adm… Qloapps No fix yet Fix from $1,9502025-06-17 MEDIUM 5.4 CVE-2025-3568 A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Affected by this vulnerability is an unknown functiona… Krayin Crm No fix yet Fix from $1,6002025-04-14 MEDIUM 6.1 CVE-2025-1155 A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the comp… Qloapps No fix yet Fix from $1,6002025-02-10 CRITICAL 9.6 CVE-2024-46367 A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submittin… Krayin Crm Mitigation only Fix from $2,3002024-09-27 HIGH 8.8 CVE-2024-46366 A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template co… Krayin Crm Mitigation only Fix from $1,9502024-09-27 HIGH 7.2 CVE-2024-40318 An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file. Qloapps No fix yet Fix from $1,9502024-07-25 MEDIUM 6.5 CVE-2023-36238 Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter. Bagisto No fix yet Fix from $1,6002024-03-13 CRITICAL 9.8 CVE-2023-51210 SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the id_product parameters in the Up… Bundle Product No fix yet Fix from $2,3002024-01-23 MEDIUM 5.4 CVE-2023-37636 A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a… Uvdesk No fix yet Fix from $1,6002023-10-23 HIGH 7.8 CVE-2023-39147 An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file. Uvdesk No fix yet Fix from $1,9502023-08-01 HIGH 8.8 CVE-2023-33570 Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Bagisto No fix yet Fix from $1,9502023-06-28 HIGH 7.5 CVE-2023-36284 An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attack… Qloapps No fix yet Fix from $1,9502023-06-23 MEDIUM 6.1 CVE-2023-36287 An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and th… Qloapps No fix yet Fix from $1,6002023-06-23 MEDIUM 6.1 CVE-2023-36289 An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and th… Qloapps No fix yet Fix from $1,6002023-06-23 MEDIUM 5.4 CVE-2023-36288 An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and th… Qloapps No fix yet Fix from $1,6002023-06-23 MEDIUM 5.4 CVE-2023-2925 A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4. This affects an unknown part of the file /admin/contacts/… Krayin Crm No fix yet Fix from $1,6002023-05-27 MEDIUM 6.1 CVE-2023-30256EPSS 9% Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_cr… Qloapps No fix yet Fix from $1,6002023-05-11 HIGH 8.8 CVE-2019-14933 Bagisto 0.1.5 allows CSRF under /admin URIs. Bagisto No fix yet Fix from $1,9502019-08-11 MEDIUM 5.0 CVE-2010-1659EPSS 14% Directory traversal vulnerability in the Ultimate Portfolio (com_ultimateportfolio) component 1.0 for Joomla! allows remote attackers to read arbitra… Com Ultimateportfolio No fix yet Fix from $1,6002010-05-03