Skip to content
Noroxi

Webkul records

57 published records for vendor webkul.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
8
With a fix record
45.6%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 22
  3. 23
  4. 24
  5. 25
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

57 records
  • CVE-2024-0916
    40Plan

    Unauthenticated Remote Code Execution in UvDesk Community

    CriticalCVSS 10.0No exploitEPSS 1%

    webkul software · uvdesk communityApr 25, 2024

  • CVE-2023-51210
    39Monitor

    SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the id_product parameters

    CriticalCVSS 9.8No exploitEPSS 1%

    webkul · bundle productJan 23, 2024

  • CVE-2025-67325
    39Monitor

    Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achiev

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    webkul · qloappsJan 8, 2026

  • CVE-2024-46367
    38Monitor

    A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by

    CriticalCVSS 9.6No exploitEPSS 1%

    webkul · krayin crmSep 27, 2024

  • CVE-2019-16403
    35Monitor

    In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can als

    HighCVSS 8.8No exploitEPSS 1%

    webkul · bagistoSep 18, 2019

  • CVE-2023-33570
    35Monitor

    Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).

    HighCVSS 8.8No exploitEPSS 1%

    webkul · bagistoJun 28, 2023

  • CVE-2026-21448
    35Monitor

    Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

    HighCVSS 8.9No exploitEPSS 1%

    webkul · bagistoJan 2, 2026

  • CVE-2026-38529
    35Monitor

    A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated att

    HighCVSS 8.8No exploitEPSS 1%

    webkul · krayin crmApr 14, 2026

  • CVE-2026-21446
    35Monitor

    Bagisto Missing Authentication on Installer API Endpoints

    HighCVSS 8.8No exploitEPSS 1%

    webkul · bagistoJan 2, 2026

  • CVE-2019-14933
    35Monitor

    Bagisto 0.1.5 allows CSRF under /admin URIs.

    HighCVSS 8.8No exploitEPSS 1%

    webkul · bagistoAug 11, 2019

  • CVE-2024-46366
    35Monitor

    A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side te

    HighCVSS 8.8No exploitEPSS 1%

    webkul · krayin crmSep 27, 2024

  • CVE-2017-20262
    35Monitor

    Joomla! Component Ajax Quiz 1.8 SQL Injection

    HighCVSS 8.8No exploitEPSS 0%

    webkul · ajax quizJun 19, 2026

  • CVE-2023-36237
    35Monitor

    Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script.

    HighCVSS 8.8No exploitEPSS 0%

    webkul · bagistoFeb 26, 2024

  • CVE-2025-60880
    33Monitor

    An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a

    HighCVSS 8.3Proof of conceptEPSS 0%

    webkul · bagistoOct 10, 2025

  • CVE-2025-55741
    32Monitor

    unopim/unopim allows unauthorized product deletion via mass-delete endpoint

    HighCVSS 8.1No exploitEPSS 0%

    webkul · unopimAug 22, 2025

  • CVE-2026-38532
    32Monitor

    A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenti

    HighCVSS 8.1No exploitEPSS 0%

    webkul · krayin crmApr 14, 2026

  • CVE-2026-38530
    32Monitor

    A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authentic

    HighCVSS 8.1No exploitEPSS 0%

    webkul · krayin crmApr 14, 2026

  • CVE-2023-36284
    31Monitor

    An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remo

    HighCVSS 7.5Proof of conceptEPSS 3%

    webkul · qloappsJun 23, 2023

  • CVE-2023-39147
    31Monitor

    An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.

    HighCVSS 7.8Proof of conceptEPSS 1%

    webkul · uvdeskAug 1, 2023

  • CVE-2026-21450
    29Monitor

    Bagisto has SSTI in parameter that can lead to RCE

    HighCVSS 7.3No exploitEPSS 1%

    webkul · bagistoJan 2, 2026

  • CVE-2026-21449
    29Monitor

    Bagisto has SSTI via first and last name from low-privilege user (not admin)

    HighCVSS 7.4No exploitEPSS 1%

    webkul · bagistoJan 2, 2026

  • CVE-2025-55743
    29Monitor

    UnoPim vulnerable to remote code execution through Arbitrary File upload

    HighCVSS 7.3No exploitEPSS 0%

    webkul · unopimAug 21, 2025

  • CVE-2024-40318
    28Monitor

    An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file.

    HighCVSS 7.2Proof of conceptEPSS 1%

    webkul · qloappsJul 25, 2024

  • CVE-2025-62417
    28Monitor

    bagisto - CSV Formula Injection in Create New Product

    HighCVSS 7.1No exploitEPSS 0%

    webkul · bagistoOct 16, 2025

  • CVE-2026-21447
    28Monitor

    Bagisto has IDOR in Customer Order Reorder Functionality

    HighCVSS 7.1No exploitEPSS 0%

    webkul · bagistoJan 2, 2026