Loading vulnerability details…
CVSS v3.1
4.2
EPSS
0.21%
Published
Feb 18, 2025
Modified
Jul 9, 2025
Public PoC / Exploit (1)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application appends sensitive authentication tokens directly to the URL.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:LWeaknesses (CWE)
Affected Products (1)
References (1)