← Back

CVE-2025-26058

nvd nist
Published: Feb 18, 2025Modified: Jun 17, 2026

JSON object

Loading...
4.2
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Exploitability: 0.8 / Impact: 3.4
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application appends sensitive authentication tokens directly to the URL.

Affected (1)

Products: Webkul: Qloapps
Webkul
1 product
Qloapps
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Qloapps
Version 1.6.1

Related CWEs

CWE-598
Use of GET Request Method With Sensitive Query Strings
The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

References (1)

Source: cve@mitre.org
ExploitThird Party Advisory

Timeline

No history available yet.