CVE-2026-115326 | Webkul QloApps up to 1.7.0 Refund Submission displayAjaxSubmitRefundRequest id_service_product_order_detail/id_order resource injection

October 22, 2026 Yanac

A vulnerability was found in Webkul QloApps up to 1.7.0. It has been rated as critical. Affected by this vulnerability is the function OrderDetailController::displayAjaxSubmitRefundRequest of the component Refund Submission. Performing a manipulation of the argument id_service_product_order_detail/id_order results in improper control of resource identifiers.

This vulnerability is identified as CVE-2026-115326. The attack can be initiated remotely. There is not any exploit available.VulDB Recent EntriesRead More