CVE-2026-75497: Webkul Qloapps

High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days.

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.

Affected products

• Webkul Qloapps: before 123c97c (fixed in 123c97c)

Published 2026-08-25. Last modified 2026-08-26.