SQL Injection Vulnerability in Webkul QloApps Affects Database Security
CVE-2026-75498

8.6HIGH

Key Information:

Vendor

Webkul

Status
Qloapps
Vendor
CVE Published:
25 August 2026

What is CVE-2026-75498?

A vulnerability in Webkul QloApps allows remote, authenticated attackers with administrative privileges to manipulate database queries through the 'bo_query' parameter in the 'Address.php' file. This weakness arises due to the application's failure to validate request parameters properly, enabling the execution of arbitrary SQL commands. A patch has been released to address this issue, ensuring better input validation to protect against such attacks.

Affected Version(s)

QloApps 0 < 123c97c

QloApps 123c97c

References

https://github.com/Qloapps/QloApps/pull/1783/changes/123c...
patch
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2026-75498
vdb-entry

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153
.