Veille CVE

Semaine du 14 septembre au 20 septembre 2026

2 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Webkul QloApps » ✕
  1. CVE-2026-93988 6.5 Moyenne

    webkul qloapps

    QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.

  2. CVE-2026-92234 5.4 Moyenne

    Webkul QloApps

    QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.