PatchTheCVEqloapps vulnerabilities and fixes
Recent CVEs affecting qloapps, with upgrade or downgrade steps. 7 tracked.
qloapps has 7 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-01-12. Highest priority: CVE-2025-67325 (score 62/100).
- CVE-2025-6173 MEDIUM 4.7 DOWNGRADE A vulnerability classified as critical was found in Webkul QloApps 1.6.1
- CVE-2025-67325 CRITICAL 9.8 UPGRADE Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unaut
- CVE-2025-26058 MEDIUM 4.2 DOWNGRADE Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection
- CVE-2025-1155 MEDIUM 4.3 DOWNGRADE A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1
- CVE-2025-1074 MEDIUM 4.3 DOWNGRADE A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1
- CVE-2025-10759 MEDIUM 5.3 UPGRADE A vulnerability was detected in Webkul QloApps up to 1.7.0
- CVE-2021-41074 MEDIUM 5.4 DOWNGRADE A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email addr
FAQ
How do I fix qloapps vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is qloapps being exploited right now?
None of the tracked qloapps CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which qloapps CVE should I patch first?
CVE-2025-67325 currently ranks highest (62/100): Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unaut.