Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

Webkul Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-89268`QloApps through 1.7.0 Reflected XSS via List Filter Parameters	Exploitation statusNot confirmed	FixYes	Affected productQloApps	Published09/12/2026	SeverityMedium
`CVE-2026-75498`Webkul QloApps SQL injection	Exploitation statusPublic exploit	FixYes	Affected productQloApps	Published08/25/2026	SeverityHigh
`CVE-2026-75497`Webkul QloApps SQL injection	Exploitation statusPublic exploit	FixYes	Affected productQloApps	Published08/25/2026	SeverityHigh
`CVE-2026-75496`Webkul QloApps improper file upload validation	Exploitation statusPublic exploit	FixYes	Affected productQloApps	Published08/25/2026	SeverityHigh
`CVE-2026-75082`Webkul Bagisto Customer-Registration Notification Email register cross site scripting	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published08/18/2026	SeverityMedium
`CVE-2026-75081`Webkul Bagisto store behavioral workflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published08/17/2026	SeverityMedium
`CVE-2026-19997`Webkul Bagisto Backend Sales RMA Endpoint requests authorization	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published08/17/2026	SeverityMedium
`CVE-2026-19996`Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published08/17/2026	SeverityMedium
`CVE-2026-19995`Webkul Bagisto RMA Message send-message cross site scripting	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published08/17/2026	SeverityMedium
`CVE-2026-19994`Webkul Bagisto Configuration Management execute authorization	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published08/17/2026	SeverityMedium
`CVE-2026-19993`Webkul Bagisto RMA State Validation update-status behavioral workflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published08/17/2026	SeverityMedium
`CVE-2026-19838`Webkul Bagisto Backend Reporting Endpoint sales authorization	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published08/14/2026	SeverityMedium
`CVE-2026-19837`Webkul Bagisto Customer Search search information disclosure	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published08/14/2026	SeverityMedium
`CVE-2026-19836`Webkul Bagisto Backend Customer Detail Feature view authorization	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published08/14/2026	SeverityMedium
`CVE-2026-19835`Webkul Bagisto Customer Item Deletion Endpoint access control	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published08/14/2026	SeverityMedium
`CVE-2026-19834`Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published08/14/2026	SeverityMedium
`CVE-2026-60120`Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php	Exploitation statusNot known exploited	FixYes	Affected productBagisto	Published07/09/2026	SeverityMedium
`CVE-2017-20262`Joomla! Component Ajax Quiz 1.8 SQL Injection	Exploitation statusPublic exploit	FixNot confirmed	Affected productAjax Quiz	Published06/19/2026	SeverityHigh
`CVE-2026-9506`Path Traversal Vulnerability in Bagisto	Exploitation statusNot known exploited	FixYes	Affected productBagisto	Published06/08/2026	SeverityHigh
`CVE-2026-38530`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published04/14/2026	SeverityHigh
`CVE-2026-38529`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published04/14/2026	SeverityHigh
`CVE-2026-38532`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published04/14/2026	SeverityHigh
`CVE-2021-41074`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published01/12/2026	SeverityMedium
`CVE-2025-67325`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published01/08/2026	SeverityCritical
`CVE-2026-21450`Bagisto has SSTI in parameter that can lead to RCE	Exploitation statusNot known exploited	FixNot confirmed	Affected productBagisto	Published01/02/2026	SeverityHigh
`CVE-2026-21451`Bagisto has HTML Filter Bypass that Enables Stored XSS	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published01/02/2026	SeverityMedium
`CVE-2026-21449`Bagisto has SSTI via first and last name from low-privilege user (not admin)	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published01/02/2026	SeverityHigh
`CVE-2026-21448`Bagisto has Normal & Blind SSTI from low-privilege user when ordering product	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published01/02/2026	SeverityHigh
`CVE-2026-21447`Bagisto has IDOR in Customer Order Reorder Functionality	Exploitation statusPublic exploit	FixNot confirmed	Affected productBagisto	Published01/02/2026	SeverityHigh
`CVE-2026-21446`Bagisto Missing Authentication on Installer API Endpoints	Exploitation statusNot known exploited	FixNot confirmed	Affected productBagisto	Published01/02/2026	SeverityHigh
`CVE-2025-62415`bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)	Exploitation statusPublic exploit	FixYes	Affected productBagisto	Published10/16/2025	SeverityMedium
`CVE-2025-62418`bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)	Exploitation statusPublic exploit	FixYes	Affected productBagisto	Published10/16/2025	SeverityMedium
`CVE-2025-62414`bagisto - Cross Site Scripting (XSS) in Create New Customer	Exploitation statusPublic exploit	FixYes	Affected productBagisto	Published10/16/2025	SeverityMedium
`CVE-2025-62416`bagisto - Server Side Template Injection (SSTI) in Product Description	Exploitation statusPublic exploit	FixYes	Affected productBagisto	Published10/16/2025	SeverityMedium
`CVE-2025-62417`bagisto - CSV Formula Injection in Create New Product	Exploitation statusPublic exploit	FixYes	Affected productBagisto	Published10/16/2025	SeverityHigh
`CVE-2025-60880`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published10/10/2025	SeverityHigh
`CVE-2025-56426`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published10/09/2025	SeverityMedium
`CVE-2025-10759`Webkul QloApps CSRF Token authorization	Exploitation statusPublic exploit	FixNot confirmed	Affected productQloApps	Published09/21/2025	SeverityMedium
`CVE-2025-55745`UnoPim Quick Export feature is vulnerable to CSV injection	Exploitation statusPublic exploit	FixNot confirmed	Affected productunopim	Published08/22/2025	SeverityLow
`CVE-2025-55741`unopim/unopim allows unauthorized product deletion via mass-delete endpoint	Exploitation statusPublic exploit	FixYes	Affected productunopim	Published08/22/2025	SeverityHigh
`CVE-2025-55744`UnoPim vulnerable to CSRF on Product edit feature and creation of other types	Exploitation statusPublic exploit	FixYes	Affected productunopim	Published08/21/2025	SeverityMedium
`CVE-2025-55743`UnoPim vulnerable to remote code execution through Arbitrary File upload	Exploitation statusPublic exploit	FixYes	Affected productunopim	Published08/21/2025	SeverityHigh
`CVE-2025-55742`UnoPim Stored XSS via SVG MIME/Sanitizer Bypass	Exploitation statusPublic exploit	FixYes	Affected productunopim	Published08/21/2025	SeverityHigh
`CVE-2025-29009`WordPress Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Arbitrary File Upload Vulnerability	Exploitation statusNot known exploited	FixYes	Affected productMedical Prescription Attachment Plugin for WooCommerce	Published07/16/2025	SeverityCritical
`CVE-2025-6173`Webkul QloApps ajax_products_list.php sql injection	Exploitation statusPublic exploit	FixNot confirmed	Affected productQloApps	Published06/17/2025	SeverityMedium
`CVE-2025-40675`Reflected Cross-Site Scripting (XSS) in Bagisto	Exploitation statusNot known exploited	FixNot confirmed	Affected productBagisto	Published06/09/2025	SeverityMedium
`CVE-2025-3568`Webkul Krayin CRM SVG File edit cross site scripting	Exploitation statusPublic exploit	FixNot confirmed	Affected productkrayin crm	Published04/14/2025	SeverityMedium
`CVE-2025-26058`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published02/18/2025	SeverityMedium
`CVE-2025-1155`Webkul QloApps Your Location Search stores cross site scripting	Exploitation statusPublic exploit	FixNot confirmed	Affected productQloApps	Published02/10/2025	SeverityMedium
`CVE-2025-1074`Webkul QloApps URL mylogout cross-site request forgery	Exploitation statusPublic exploit	FixNot confirmed	Affected productQloApps	Published02/06/2025	SeverityMedium
`CVE-2024-11281`WooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change	Exploitation statusNot known exploited	FixYes	Affected productWooCommerce Point of Sale	Published12/25/2024	SeverityCritical
`CVE-2024-52305`UnoPim Stored XSS : Cookie hijacking through Create User function	Exploitation statusPublic exploit	FixYes	Affected productunopim	Published11/13/2024	SeverityMedium
`CVE-2024-50637`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published11/06/2024	SeverityMedium
`CVE-2024-45932`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published10/07/2024	SeverityHigh
`CVE-2024-46366`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published09/27/2024	SeverityHigh
`CVE-2024-46367`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published09/27/2024	SeverityCritical
`CVE-2024-40318`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published07/25/2024	SeverityHigh
`CVE-2023-36238`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published03/13/2024	SeverityMedium
`CVE-2024-27499`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published03/01/2024	SeverityMedium
`CVE-2023-36237`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published02/26/2024	SeverityHigh
`CVE-2023-51210`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published01/23/2024	SeverityCritical
`CVE-2023-36235`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published01/17/2024	SeverityMedium
`CVE-2023-36236`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published01/16/2024	SeverityMedium
`CVE-2023-37636`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published10/23/2023	SeverityUnknown
`CVE-2023-39147`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published08/01/2023	SeverityUnknown
`CVE-2023-33570`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published06/28/2023	SeverityUnknown
`CVE-2023-36288`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published06/23/2023	SeverityUnknown
`CVE-2023-36284`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published06/23/2023	SeverityUnknown
`CVE-2023-36287`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published06/23/2023	SeverityUnknown
`CVE-2023-36289`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published06/23/2023	SeverityUnknown
`CVE-2023-2925`Webkul krayin crm Edit Person Page 2 cross site scripting	Exploitation statusPublic exploit	FixNot confirmed	Affected productkrayin crm	Published05/27/2023	SeverityLow
`CVE-2023-30256`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published05/11/2023	SeverityMedium
`CVE-2021-41924`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published06/21/2022	SeverityUnknown
`CVE-2019-16403`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published09/18/2019	SeverityUnknown
`CVE-2019-14933`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published08/11/2019	SeverityUnknown
`CVE-2010-1659`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published04/30/2010	SeverityUnknown