SQL Injection Vulnerability in Webkul QloApps Product
CVE-2026-75497

8.6HIGH

Key Information:

Vendor

Webkul

Status
Qloapps
Vendor
CVE Published:
25 August 2026

What is CVE-2026-75497?

Webkul QloApps contains a vulnerability due to inadequate validation of request parameters before executing database queries. An authenticated attacker with administrative privileges could exploit this flaw by crafting a malicious SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. This exploitation could potentially lead to unauthorized data manipulation or disclosure within the application.

Affected Version(s)

QloApps 0 < 123c97c

QloApps 123c97c

References

https://github.com/Qloapps/QloApps/pull/1783/changes/123c...
patch
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2026-75497
vdb-entry

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153
.