CVE-2025-26058

4.2 mediumEPSS 0.2%

Medium (4.2) in webkul qloapps. EPSS 0.2% chance of exploitation in the next 30 days.

Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application appends sensitive authentication tokens directly to the URL.

Severity

CVSS 3.1

4.2 medium

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-598
Published: 2025-02-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

webkul:qloapps

References

https://github.com/mano257200/QloApps-VUL

Check your stack JSON