Is CVE-2026-75497 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-75497?

CVE-2026-75497 has a CVSS v3 severity of HIGH (7.2).

Back

CVE-2026-75497

Description

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.