CVE-2025-1074

MEDIUM

Webkul QloApps 1.6.1 - Cross-Site Request Forgery via Logout Function

Title source: llm
STIX 2.1

Description

A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the component URL Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. They are aware about it and are working on resolving it.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.294834
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.294834
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.491600

Scores

CVSS v3 4.3
EPSS 0.0029
EPSS Percentile 20.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-352 CWE-862
Status published
Products (1)
webkul/qloapps 1.6.1
Published Feb 06, 2025
Tracked Since Feb 18, 2026