Security Advisory

CVE-2026-75497

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-25 16:37:10

Last updated 2026-08-25 18:05:58

Assigner cisa-cg

CVSS score 8.6

State PUBLISHED

Description

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.

← Browse all CVEs View on cve.org ↗