Webkul
Webkul Security Releases - October 2026
webkul-2026-10 Oct 1, 2026 Source: Vendor
Webkul security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-109393
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
15 lines
Showing 1–15 of 15
CVE-2026-109393
BR2026-0000-027111
QloApps
unclaimed
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and A...
Credited as leediay153 from Viettel Post
CVE-2026-110218
BR2026-0000-029202
Aureus ERP
unclaimed
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers ...
Credited as leediay153 from Viettel Post
CVE-2026-110219
BR2026-0000-029203
QloApps
unclaimed
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities for...
Credited as leediay153 from Viettel Post
CVE-2026-110221
BR2026-0000-029205
QloApps
unclaimed
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature_price_name and impact_value POST values unescaped after...
Credited as leediay153 from Viettel Post
CVE-2026-110224
BR2026-0000-029208
QloApps
unclaimed
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors...
Credited as leediay153 from Viettel Post
CVE-2026-110226
BR2026-0000-029210
QloApps
unclaimed
QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hot...
Credited as leediay153 from Viettel Post
CVE-2026-110229
BR2026-0000-029212
QloApps
unclaimed
QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can...
Credited as leediay153 from Viettel Post
CVE-2026-111284
BR2026-0000-032897
Aureus ERP
unclaimed
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlStri...
Credited as leediay153 from Viettel Post
CVE-2026-105836
BR2026-0000-036981
QloApps
unclaimed
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of oth...
Credited as leediay153 from Viettel Post
CVE-2026-112190
BR2026-0000-040232
Aureus ERP
unclaimed
A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive ...
Credited as Karan Parelkar
CVE-2026-112190
BR2026-0000-040233
Aureus ERP
unclaimed
A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive ...
Credited as Devansh Sanghvi
CVE-2026-112190
BR2026-0000-040234
Aureus ERP
unclaimed
A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive ...
Credited as Devansh33
CVE-2026-112193
BR2026-0000-040349
Aureus ERP
unclaimed
A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performi...
Credited as Karan Parelkar
CVE-2026-112193
BR2026-0000-040350
Aureus ERP
unclaimed
A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performi...
Credited as Devansh Sanghvi
CVE-2026-112193
BR2026-0000-040351
Aureus ERP
unclaimed
A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performi...
Credited as Devansh33