PT-2025-38648
CVE-2025-10759
·
Published
2025-09-21
·
Updated
2025-10-30
Description by
CVSS 4.0
5.5
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Name of the Vulnerable Software and Affected Versions
Webkul QloApps versions up to 1.7.0
Description
A flaw exists in the CSRF Token Handler component of Webkul QloApps. Manipulation of the
token argument within an unknown function can lead to authorization bypass. This issue can be exploited remotely. The exploit is publicly available.Recommendations
Versions prior to the next major release are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾