CVE-2025-26058

Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection

Medium · published February 18, 2025

CVSS v3.1
4.2
EPSS
0%
Percentile
11.6
In the wild
Unconfirmed
What it is

Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application appends sensitive authentication tokens directly to the URL.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00218 · 11.6th percentile
Published
2025-02-18T00:00Z
EPSS history
Timeline
  • 18 FEB 00:00Z
    Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection
    cvelistv5