https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:20:45 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-358896 EUVD-2026-358896 https://cve.radiocsirt.org/vuln/euvd-2026-358896 https://cve.radiocsirt.org/vuln/fkie_cve-2026-75498 <p>Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the &#39;bo_query&#39; parameter in the &#39;Address.php&#39; file. Fixed in 123c97c.</p> <p>Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the &#39;bo_query&#39; parameter in the &#39;Address.php&#39; file. Fixed in 123c97c.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-75498 https://cve.radiocsirt.org/vuln/ghsa-mj48-jjc7-6wqr <p>Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the &#39;bo_query&#39; parameter in the &#39;Address.php&#39; file. Fixed in 123c97c.</p> <p>Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the &#39;bo_query&#39; parameter in the &#39;Address.php&#39; file. Fixed in 123c97c.</p> https://cve.radiocsirt.org/vuln/ghsa-mj48-jjc7-6wqr https://cve.radiocsirt.org/vuln/va-26-237-01 <p>Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c. Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the &#39;bo_query&#39; parameter in the &#39;CustomerMessage.php&#39; file. Fixed in 123c97c. Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the &#39;bo_query&#39; parameter in the &#39;Address.php&#39; file. Fixed in 123c97c.</p> <p>Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c. Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the &#39;bo_query&#39; parameter in the &#39;CustomerMessage.php&#39; file. Fixed in 123c97c. Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the &#39;bo_query&#39; parameter in the &#39;Address.php&#39; file. Fixed in 123c97c.</p> https://cve.radiocsirt.org/vuln/va-26-237-01