CVE-2025-10759

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-10759
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-10759.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-10759
Published
2025-09-21T01:02:06Z
Modified
2026-08-27T03:56:59Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Webkul QloApps CSRF Token authorization
Details

A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of the argument token results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. The vendor explains: "As We are already aware about this vulnerability and our Internal team are already working on this issue. (...) We'll implement the fix for this vulnerability in our next major release."

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-285",
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10759.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0"
                },
                {
                    "last_affected": "1.0"
                },
                {
                    "introduced": "1.1"
                },
                {
                    "last_affected": "1.1"
                },
                {
                    "introduced": "1.2"
                },
                {
                    "last_affected": "1.2"
                },
                {
                    "introduced": "1.3"
                },
                {
                    "last_affected": "1.3"
                },
                {
                    "introduced": "1.4"
                },
                {
                    "last_affected": "1.4"
                },
                {
                    "introduced": "1.5"
                },
                {
                    "last_affected": "1.5"
                },
                {
                    "introduced": "1.6"
                },
                {
                    "last_affected": "1.6"
                },
                {
                    "introduced": "1.7.0"
                },
                {
                    "last_affected": "1.7.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/Qloapps/QloApps

Affected ranges

Type
GIT
Repo
https://github.com/Qloapps/QloApps
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
f768898c20c43cb0733a6099e390e5be71631393
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:webkul:qloapps:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.7.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v0.*
v0.3
v1.*
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.5.0
v1.5.2
v1.6.0
v1.6.1
v1.7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-10759.json"