CVE-2026-75498: Webkul QloApps SQL injection

Published Aug 25, 2026

Updated

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'Address.php' file. Fixed in 123c97c.

Affected Software

1 affected component

Webkul QloApps

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Webkul QloApps to a version that resolves this vulnerability.
Fixed in 123c97c

Event History

Aug 25, 2026

CVE Published

via MITRE·04:37 PM

Data Sourced

via MITRE·04:37 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires remote access and authenticated administrative privileges. Unauthenticated users and lower-privileged authenticated users are not identified as able to exploit it.

Which component and parameter should be reviewed?

The affected database query is in Address.php and uses the bo_query request parameter. Review administrative requests reaching that parameter for crafted SQL input.

What is the remediation?

Update to a QloApps version or source revision that includes commit 123c97c. The provided data does not identify a numbered release containing the fix.