{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "title": "Webkul QloApps multiple vulnerabilities",
    "tracking": {
      "current_release_date": "2026-08-25T16:12:44Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.15.0+build.101"
        }
      },
      "id": "VA-26-237-01",
      "initial_release_date": "2026-08-25T16:12:44Z",
      "status": "final",
      "version": "1.0.0",
      "revision_history": [
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2026-08-25T16:12:44Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors",
        "category": "other"
      },
      {
        "text": "Webkul QloApps contains a remote code execution and SQL injection vulnerabilities. A remote attacker with administrative privileges could upload executable files and achieve remote code execution or send a crafted SQL query that bypasses validation.",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "text": "Fixed in 153ec1c and 123c97c.",
        "title": "Recommended Practices",
        "category": "general"
      },
      {
        "text": "India",
        "title": "Company Headquarters Location",
        "category": "other"
      }
    ],
    "references": [
      {
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-237-01.json",
        "summary": "Vulnerability Advisory VA-26-237-01 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Webkul",
        "branches": [
          {
            "category": "product_name",
            "name": "QloApps",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<153ec1c",
                "product": {
                  "name": "Webkul QloApps <153ec1c",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "153ec1c",
                "product": {
                  "name": "Webkul QloApps 153ec1c",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version_range",
                "name": "<123c97c",
                "product": {
                  "name": "Webkul QloApps <123c97c",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version",
                "name": "123c97c",
                "product": {
                  "name": "Webkul QloApps 123c97c",
                  "product_id": "CSAFPID-0004"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "QloApps",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<153ec1c",
                "product": {
                  "name": "Webkul QloApps <153ec1c",
                  "product_id": "CSAFPID-0005"
                }
              },
              {
                "category": "product_version",
                "name": "153ec1c",
                "product": {
                  "name": "Webkul QloApps 153ec1c",
                  "product_id": "CSAFPID-0006"
                }
              },
              {
                "category": "product_version_range",
                "name": "<123c97c",
                "product": {
                  "name": "Webkul QloApps <123c97c",
                  "product_id": "CSAFPID-0007"
                }
              },
              {
                "category": "product_version",
                "name": "123c97c",
                "product": {
                  "name": "Webkul QloApps 123c97c",
                  "product_id": "CSAFPID-0008"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "QloApps",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<153ec1c",
                "product": {
                  "name": "Webkul QloApps <153ec1c",
                  "product_id": "CSAFPID-0009"
                }
              },
              {
                "category": "product_version",
                "name": "153ec1c",
                "product": {
                  "name": "Webkul QloApps 153ec1c",
                  "product_id": "CSAFPID-0010"
                }
              },
              {
                "category": "product_version_range",
                "name": "<123c97c",
                "product": {
                  "name": "Webkul QloApps <123c97c",
                  "product_id": "CSAFPID-0011"
                }
              },
              {
                "category": "product_version",
                "name": "123c97c",
                "product": {
                  "name": "Webkul QloApps 123c97c",
                  "product_id": "CSAFPID-0012"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-75496",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:T/2026-08-17T20:27:36Z/"
        }
      ],
      "title": "Webkul QloApps improper file upload validation",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ],
        "fixed": [
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/Qloapps/QloApps/pull/1801/commits/153ec1c8567798bd99155098ecc0a340e38f25bf"
        },
        {
          "category": "external",
          "summary": "VA-26-237-01 CSAF",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-237-01.json"
        },
        {
          "category": "external",
          "summary": "CVE-2026-75496",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75496"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 153ec1c.",
          "url": "https://github.com/Qloapps/QloApps/pull/1801/commits/153ec1c8567798bd99155098ecc0a340e38f25bf",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2026-07-20T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 153ec1c.",
          "url": "https://github.com/Qloapps/QloApps/pull/1801/commits/153ec1c8567798bd99155098ecc0a340e38f25bf",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2026-07-20T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "leediay153"
          ]
        }
      ],
      "release_date": "2026-07-20T00:00:00Z"
    },
    {
      "cve": "CVE-2026-75497",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:T/2026-08-18T14:32:30Z/"
        }
      ],
      "title": "Webkul QloApps SQL injection",
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ],
        "fixed": [
          "CSAFPID-0004"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/Qloapps/QloApps/pull/1783/changes/123c97c110b7053ea3297d8e58fe95b3c3536560"
        },
        {
          "category": "external",
          "summary": "VA-26-237-01 CSAF",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-237-01.json"
        },
        {
          "category": "external",
          "summary": "CVE-2026-75497",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75497"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 123c97c.",
          "url": "https://github.com/Qloapps/QloApps/pull/1783/changes/123c97c110b7053ea3297d8e58fe95b3c3536560",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "date": "2026-08-13T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 123c97c.",
          "url": "https://github.com/Qloapps/QloApps/pull/1783/changes/123c97c110b7053ea3297d8e58fe95b3c3536560",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "date": "2026-08-13T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "leediay153"
          ]
        }
      ],
      "release_date": "2026-08-13T00:00:00Z"
    },
    {
      "cve": "CVE-2026-75498",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:T/2026-08-18T14:33:09Z/"
        }
      ],
      "title": "Webkul QloApps SQL injection",
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ],
        "fixed": [
          "CSAFPID-0004"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/Qloapps/QloApps/pull/1783/changes/123c97c110b7053ea3297d8e58fe95b3c3536560"
        },
        {
          "category": "external",
          "summary": "VA-26-237-01 CSAF",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-237-01.json"
        },
        {
          "category": "external",
          "summary": "CVE-2026-75498",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75498"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 123c97c.",
          "url": "https://github.com/Qloapps/QloApps/pull/1783/changes/123c97c110b7053ea3297d8e58fe95b3c3536560",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "date": "2026-08-13T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 123c97c.",
          "url": "https://github.com/Qloapps/QloApps/pull/1783/changes/123c97c110b7053ea3297d8e58fe95b3c3536560",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "date": "2026-08-13T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "leediay153"
          ]
        }
      ],
      "release_date": "2026-08-13T00:00:00Z"
    }
  ]
}