CVE-2026-75497

Name of the Vulnerable Software and Affected Versions Webkul QloApps (affected versions not specified)

Description An issue exists where request parameters are not validated before being used in a database query. A remote, authenticated attacker with administrative privileges can execute a crafted SQL query via the bo query parameter in the 'CustomerMessage.php' file. SQL Injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database.

Recommendations Apply the fix implemented in commit 123c97c. As a temporary mitigation, restrict administrative access to the 'CustomerMessage.php' file.