VULNERABILITY INTELLIGENCE

CVE-2026-75498

CVSS score8.6 HIGH

EPSS probability0.81%

CISA KEVNot currently listed

Published2026-08-25

Last modified2026-08-26

Description

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c.