CVE-2023-36287
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.
Risk Assessment
This vulnerability poses a risk of session hijacking, which could lead to unauthorized access to user accounts and data.
Recommendation
It is recommended to update Webkul QloApps to the latest version to mitigate this vulnerability and implement additional security measures against XSS attacks.
Other vulnerabilities in Webkul QloApps 1.6.0
See all- CVE-2026-75498High
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c.
- CVE-2026-75497High
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.
- CVE-2026-75496High
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.
- CVE-2023-36284High
An unauthenticated Time-Based SQL injection was found in Webkul QloApps version 1.6.0 via GET parameters date_from, date_to, and id_product. This allows a remote attacker to bypass the web application's authentication and authorization mechanisms and retrieve the contents of an entire database.
- CVE-2023-36289Medium
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie. This enables the attacker to impersonate that user via POST email_create and back parameter.
- CVE-2023-36288Medium
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter.
Original NVD description (English source)
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS